Enuma Model
Three-Party Talent Marketplace
Three-party talent marketplace (models · creators · agencies)
What it is
Enuma Model is a global talent marketplace built on three interlocking flows - models, creators, and agencies are three genuinely separate experiences, not one signup form with a dropdown. Models publish portfolios and take bookings; creators run castings and commission work; agencies run rosters and manage bookings for their talent. Engagements move through built-in messaging and a complete Stripe Connect settlement path - escrow capture, dispute window, automated payout release, with per-booking isolation so a single failure never blocks another party's payout - currently operating in test mode ahead of the commercial switch-on. Money is held as integer cents, and every split is checked against a conservation rule enforced inside the database, so funds cannot be created or lost by a defect in application code. Access control is enforced by the database itself rather than remembered by application code, sensitive personal columns are unreadable by any public or logged-in role, and a zero-knowledge vault - staged for release - encrypts the most sensitive files in the browser before they ever leave the device. Every administrative action is written into a tamper-evident record the platform re-verifies daily on its own. It is live today at enumamodel.com.
What is built, and what is ahead
Live and operating: the three-party flows, bookings, castings, messaging, the moderation console, and the regression mesh. The payment spine is complete and runs in test mode ahead of the commercial switch-on. The vault, the e-sign contract library, the agency back-office suite, and the unified trust-and-safety hub are built and staged behind operator flags rather than switched on.
The numbers behind it
What it does
Three-Party Marketplace
Models, creators, and agencies each move through the marketplace on their own flow - publishing, casting, and back-office - meeting and transacting across a single storefront, with a configuration-driven entitlement engine deciding what each tier can do.
Booking, Escrow & Automated Release
Bookings capture funds up front, hold them centrally through a settlement and dispute window, and release them automatically to the model's and the agency's accounts. Each transfer carries a stable idempotency key, so a partial failure resumes where it left off instead of double-paying or dropping a payout.
A Hostile-by-Default Payment Front Door
The payment webhook is treated as an attack surface: signature-verified, size-capped before verification, replay-proof in both time directions, and idempotent - so a crash mid-payment never loses money and never books it twice.
Zero-Knowledge Vault
Sensitive files are encrypted in the browser before they ever leave the device, so a breach of Enuma's own storage would reveal nothing but ciphertext. The platform cannot read them either. Staged for release.
Messaging & Social
A full inbox with requests, paid DMs, tips, and a home feed for discovery and search - with access rules enforced inside the database, not merely checked in application code.
Continuous Regression Prevention
An autonomous release gauntlet that selects its own test set by walking the import graph from the changed files, then layers commit and push gates with live exploit replay: 207 previously-closed attack vectors are re-attacked against the real database before a single line reaches the shared branch, each fixture hash-pinned so a proof cannot be quietly weakened.
Who it serves
"Did I get paid?" stops being a phone call and becomes a state machine with a dispute window.
Discovery, negotiation, the release form, and the invoice live on a single record rather than across four applications - the booking, the contract, and the money all reference the same engagement.
The agency back office runs on software that already knows about the bookings, because the bookings happen in it.
Roster, clients, call sheets, invoicing, and compliance are built against live booking data - a back-office suite built and staged for release - with agency economics encoded in configuration rather than renegotiated deal by deal.
A supply-chain-integrity posture, expressed on a consumer marketplace.
Access control lives inside the database; personal columns are unreadable even to an authenticated role; every administrative action lands in a hash-chained record; and every attack ever closed is re-attacked before release.
What it decides, and what you decide
Each gate below is a control enforced in the software itself — not a policy statement about how it should be used.
- The regression gauntlet selects its own test set by walking the import graph, then replays 207 exploit fixtures - nobody approves it, it simply blocks
- Fifteen scheduled jobs run the marketplace unattended: payment release, dispute SLA monitoring, ledger reconciliation, daily audit-chain verification
- Product-side AI assistance, which degrades to a deterministic local result when no provider key is present and honours an operator kill-switch
- The live-key gateOperator
No real money moves until a human swaps the payment secret key. There is no code path that flips it.
- The feature-flag wallOperator
Vault, contracts, agency back-office, the trust-and-safety hub and the admin money console each require a human to arm them. Unarmed, the route returns a 404 as its first statement - not a hidden page, an absent one.
- The minor-safety gateOperator
Age and identity verification will not write a verdict unless both a live-write flag is armed and a real verification provider is wired. With neither, the route refuses rather than records. This is the hardest gate in the system and it is held shut deliberately.
- The payout step-up gateOperator
A change of payout destination can be made to require a hardware passkey ceremony on top of a cool-down period, so an attacker who has compromised an inbox and waited still cannot drain funds.
- The two-person approval queueTwo administrators
Destructive administrative actions route to a pending state requiring a second, different administrator rather than executing directly.
How it is built
- Next.js - TypeScript
- Stripe Connect settlement spine
- Booking, castings & messaging
- Supabase Postgres (row-level security)
- Browser-direct edge media storage
- Installable app with offline support
- Zero-knowledge encrypted vault (staged for release)
- E-sign contract library (staged for release)
- i18n (locale-ready)
- Import-graph regression gauntlet
- Role-scoped database security
- Column-level lockdown on personal data
- 207 hash-pinned exploit replays before every push
- Tamper-evident admin audit chain
- Two-person approval on destructive actions
- Database-enforced money conservation
What is running inside it
Every row below is attributed to this system alone and carries the state it is actually in — installed, present in source, or an honest seam.
- Installed
- present and in use in this system's own tree.
- In source
- present in source; not installed, or behind a try/except. Not a shipped capability.
- Seam
- an honest, fail-closed seam. No implementation is wired behind it.
Next.js 16 / React 19
InstalledThe marketplace runs on the current major of its framework and its rendering library rather than a version behind, so the platform's own security fixes arrive without a migration first.
WebAuthn passkeys
InstalledA hardware-backed sign-in and step-up ceremony is installed and wired, including the step-up demanded before a payout destination can change. Arming it for the live deployment is an operator act, not a background default.
Zero-knowledge encrypted vault
In sourceThe most sensitive files are encrypted in the browser before they leave the device, so the platform holds ciphertext it cannot read. Built and staged behind an operator flag rather than switched on.
Stripe Connect settlement spine
InstalledEscrow capture, a dispute window, and automated payout release, with per-booking isolation so one failure never blocks another party's payout. It runs on test keys ahead of the commercial switch-on: nothing charges a real card.
Edge rate limiting
InstalledRequest limits are enforced at the edge, before a request reaches application code or the database.
Installable application with offline support
InstalledThe marketplace installs to a device and keeps working through a dropped connection instead of presenting a blank page.
Locale-ready internationalisation
InstalledRouting and copy are structured for additional locales with no prefix on the default one. The shipped catalogue is one locale today, which is why this page says locale-ready and claims nothing beyond it.
Browser-direct presigned media upload
InstalledMedia travels from the device straight to edge storage under a short-lived signed grant, so large files never transit the application server.
Hash-pinned exploit-replay corpus, content-locked
InstalledEvery attack ever closed is re-attacked against the real database before a push lands, and each fixture is pinned by content - so weakening one, deleting one, or slipping a new one in unnoticed all fail the run.
Import-graph test selection
In sourceThe gauntlet chooses its own test set by walking the import graph outward from the changed files. The mechanism is a graph search, not a model, and it is named that way on purpose.
Unattended scheduled operations
In sourcePayment release, dispute deadline monitoring, ledger reconciliation and daily audit-chain verification run on a schedule with nobody starting them.