Skip to content

A public leaderboard: partners earning, agents spending, kept apart - #3

Merged
ralyodio merged 2 commits into
mainfrom
worktree-leaderboard
Sep 6, 2026
Merged

A public leaderboard: partners earning, agents spending, kept apart#3
ralyodio merged 2 commits into
mainfrom
worktree-leaderboard

Conversation

@ralyodio

@ralyodio ralyodio commented Sep 6, 2026

Copy link
Copy Markdown
Contributor

Adds /leaderboard to NicheDB: a public board over rows we already keep, with the two sides of the marketplace shown separately.

What it shows

Side Boards Source
Partners earning Top earners, Most referrals referral_usages
Agents spending Biggest spenders, Most passes bought crawl_sales
Crawl usage Most days of access crawl_sales

A partner earning $209 and an agent spending $209 are not the same fact, so the sides never share a list. Each has its own tab and its own actor column (Partner vs Agent), and a commission rate appears only where someone is actually earning.

No second ledger

Both tables are already the record of what happened. Copying them into leaderboard tables would be a dual write, and a dual write means the board and the ledger disagree the first time one of them fails. So the board projects the source rows live (projectionStore). Only badges get their own table (migration 0005), because they are awarded at a moment rather than derived from a sum.

Two things worth reviewing

  • The board is open to crawlers on purpose, and it needed both /leaderboard and /leaderboard/ in openPaths. The gateway prefix-matches only entries ending in a slash, so the bare path would have opened the index and still charged for every board on it. An agent that hits a 402 on the page ranking its own spend cannot read the case for buying a pass. The data itself stays paywalled.
  • Partner names come from display_name or handle, never email. This page is public.

Verified

Against a throwaway Postgres, seeded with realistic sales and referrals:

  • all five migrations apply from scratch
  • both sides rank correctly, and the buy board shows no commission
  • GPTBot gets 200 on the board, its JSON, its RSS and the widget script, and 402 on /
  • no @example.test address appears anywhere in the JSON

Screenshots of both sides are in the session; the tabs, the per-side board pills and the renamed actor column all render.

🤖 Generated with Claude Code

https://claude.ai/code/session_0144uEVbZK3jdaQkwcLYTXPE

Everything the board ranks is already recorded. Crawl passes land in
crawl_sales because an agent paid the gateway; referral commissions land in
referral_usages because a code was spent. Both are ledgers, so the board
projects them (@profullstack/leaderboard projectionStore) rather than keeping
a second copy that disagrees the first time a write fails. Only badges get a
table, because they are awarded rather than derived.

The two sides are never in one list. A partner earning $209 and an agent
spending $209 are not the same fact, so each side is its own tab with its own
actor column, and a commission rate is shown only where someone is earning.

The board is in openPaths, both with and without the trailing slash: the
gateway prefix-matches only entries ending in a slash, so '/leaderboard'
alone would open the index and still charge for every board on it. An agent
that hits a 402 on the page ranking its own spend cannot read the case for
buying a pass.

Partner names come from display_name or handle, never the email they signed
up with. This page is public.

Verified against a throwaway Postgres: migrations apply, both sides rank real
seeded rows, GPTBot reads the board at 200 while / still answers 402.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0144uEVbZK3jdaQkwcLYTXPE
@socket-security

socket-security Bot commented Sep 6, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Added@​profullstack/​leaderboard@​0.3.07610010091100

View full report

The repo lints with biome in CI and I had not run it here, so import
ordering and formatting failed the check.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0144uEVbZK3jdaQkwcLYTXPE
@ralyodio
ralyodio merged commit 4a33acb into main Sep 6, 2026
3 checks passed
@ralyodio
ralyodio deleted the worktree-leaderboard branch September 6, 2026 03:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant