Loopfund MVP: spec and status

Updated 2 September 2026, 7:50 pm CT. Three internal pages: this one is what we're building and where it stands (product, phases, decisions, next steps); /implementation is how the machine runs (architecture, the loop, money plumbing, observability, for engineers); /brand is how we talk and look (voice, vocabulary, pitch, palette, type).

What Loopfund is

Kickstarter, except the money can never reach the creator. Backers buy compute; that compute runs a hosted machine where AI agents build the creator's game against a visual bar the creator set; every dollar is visible as it is spent; whatever isn't spent is refunded. The creator's cash-out is $0 by rule, which is what lets strangers fund a project from someone they've never heard of.

Internally the build method is a Gauntlet Loop: one lead agent splits work between builder agents and fresh-context critic agents; critics compare the build blind against reference frames and can never edit; the loop runs unattended, wave after wave, until it ships, is paused, or the pot is empty. Three invariants hold everywhere:

• Critics never edit. Enforced by a tool hook, not by prompt.
• Nobody interrupts a wave. Notes from the creator land only at wave boundaries.
• Spend is capped by the pot. The run's model key has a hard dollar limit equal to what backers paid, minus a reserve.

Public copy says "project", "build", "round", "judge". "Loop", "wave", "critic", "harness" and "sandbox" are for this page and the implementation notes.

Status board

Phases

Re-sequenced on 2 September to Miguel's priorities: money and posting first, then the machine, then run-state surfaces. Checked items shipped; half-filled boxes are partly done.

Phase A: backers can pay live

• Stripe live account, hosted Checkout, webhook with signature check
• Ledger rows per payment: pledge_captured, platform_fee, pot_credit, idempotent
• Campaign flips FUNDING to FUNDED at threshold
• Receipt page reads the session, falls back to Stripe if the webhook is late
• Homepage, campaign page, checkout wired to real data
• Refund tooling (ops endpoint, pro-rata at ship/cancel, full at never-started)
• Stripe Tax

Phase B: creators can post live

• Clerk sign-in (GitHub, Google, email code), user row created on first sight
• Wizard: project and video, the bar, funding and credentials; drafts saved per step; Save and exit
• Direct-to-storage uploads for pitch video, poster, reference frames (private bucket)
• Publish requires a verified GitHub account; clear Connect GitHub path when missing
• Creator dashboard: drafts, live campaigns, what each still needs
• Production auth: Clerk production instance on clerk.loopfunder.com, GitHub + Google with our own OAuth apps, live keys on Vercel
• Edit a published campaign (currently drafts only)

Phase 0: harness in a box gate passed, first full run pending

• Docker image with Claude Code, Chromium, capture tools, hooks, loopd
• OpenRouter reachable from inside the image with direct model slugs; presets not available on this account, so slugs are pinned in env
• Critic guard hook, event log hook, StopFailure classification (billing vs transient)
• Transcript parser attributes tokens per subagent via agent_transcript_path
• The $25 run: Matt Shumer's prompt against a folder of reference frames, at least 3 unattended waves, stop reason pot_empty, transcript spend within 5% of the key's usage
• OpenRouter Management key so runs get their own capped key (Miguel: keys page, Management API section)

Phase 1: hosted machine and brakes

• E2B template from the same Dockerfile (Daytona as tested fallback)
• Run orchestrator: POST /api/runs/start mints key, boots machine, injects goal and bar; loopd posts wave results back
• Pause and resume with disk and session intact; key disabled while paused
• Chaos tests: 10 minutes of 429s, key limit to $0 mid-wave, machine killed and recovered from GitHub
• Thin pass-through proxy in front of OpenRouter for per-call reserved/settled rows (decision 5)

Phase 2: run-state surfaces

• Start run, Booting, Run console read and drive real run state
• Watch page from workbench snapshots on a CDN, verdict log, spend meter
• Episodes as GitHub Releases per wave; playable build hosting for backers
• Creator nudges queued to NUDGES.md at wave boundaries; Pause, Ship, break-glass
• Plateau checkpoint: 5 flat waves pauses and notifies; auto-cancel after 14 days of creator silence

Phase 3: later

• Backer votes between rounds
• Stripe Identity above a pot threshold; manual review queue for the first 50 campaigns
• Categories beyond games; Twitch or VOD pipeline from the shot archive

Surfaces and mocks

Every screen was mocked first, then rebuilt as HTML, then wired to the API where the backend exists. Tags say where each one is today.

State machine

One run per campaign in the MVP. Three resources are bound to a run and move together: the machine (disk and memory), the OpenRouter key, and the Claude Code session. Campaign states up to FUNDED are live today; everything from PROVISIONING on is Phase 1.

Money

Architecture

Static HTML pages fetch JSON from Vercel functions. Supabase holds the data and files. Stripe holds the money. Clerk holds identity. The machine is a Docker image today and an E2B template next; it talks to OpenRouter directly with a per-run key whose limit is the pot. The orchestrator is the one missing service.

The build loop, as it runs

loopd is the wave supervisor and lives outside Claude Code, because Claude Code's own stop hook can only block a fixed number of times and the loop must be unbounded. Each wave: loopd appends any queued creator notes to NUDGES.md, starts Claude Code with --resume on the run's session at max effort, waits for the lead to write WAVE.json (score, best frames, cost), captures the workbench, tags a GitHub Release, posts the wave to the API, and starts the next one. It stops only on pot_empty, a creator pause, or a provider failure it can't route around.

• Lead reads GOAL.md and the bar, splits the work, spawns builders and critics, decides when a wave is done.
• Builders edit the repo. Model: Fable 5.1 by default; Opus 5 on the cheaper plan.
• Critics start with fresh context, capture the same named angles from the build and the bar, and pick the better frame blind. Always Fable 5.1. A PreToolUse hook denies them every edit tool.
• Hooks log every subagent start and stop, every tool use, and every API failure to an event log the transcript parser reconciles against OpenRouter's usage counter.

Decisions

Open questions

1. Legal shape of prepaid balances. "Prepaid compute, earmarked, refundable if unused" avoids the crowdfunding money-transmitter shape, but stored-value and gift-card statutes need counsel. Refund SLA copy: initiated within 5 business days; Stripe settlement time disclosed.
2. Sales tax. Digital service; Stripe Tax not yet on.
3. Creator KYC threshold. GitHub OAuth only in MVP. At what goal size does Stripe Identity kick in? Proposed: above $2,500, plus manual review for the first 50 campaigns.
4. 24-hour machine clock. E2B caps continuous runtime; pause/resume around it vs Fly Sprites which don't cap. Decide on Phase 1 chaos-test results and price.
5. Workbench serving. Snapshots on a CDN, never a live tunnel into the machine. Snapshot cadence and cost to be set.
6. Playable hosting for backers. Needs a static build target and signed URLs; implied by "early access" but not designed.
7. No GPU. Stills and captures are fine; frame-rate claims aren't reproducible. Wizard says so; is that enough?
8. Abuse and content policy. Egress allowlist and CPU quotas are planned; what the loop is allowed to build follows Anthropic's usage policy as we are the API customer. Written policy pending.
9. Ops at 3 a.m. A run PAUSED(provider) for hours: retry, notify the creator, never refund on a provider outage. Runbook to write.
10. Capture shrinkage. Not an issue with charge-now, but declined top-ups mid-run need a UX.
11. Cloud-agent PR #1. Close without merging; add branch protection so agents open PRs and can't deploy.

Next steps

1. OpenRouter Management key MiguelFrom the keys page, Management API section. Lets each run mint its own capped key instead of sharing the inference key.
2. The first real Gauntlet LoopRun the harness locally for $25 against a folder of reference frames. Pass: 3 or more unattended waves, critic denied at least once, stops on pot_empty, transcript spend within 5% of key usage. This is the Phase 0 gate.
3. One real backingA $5 charge on Claude of the Wild with a real card, watching the ledger, wall and receipt land.
4. E2B template and orchestratorSame Dockerfile as a template; POST /api/runs/start; loopd posts waves back; pause and resume with the key disabled.
5. Run-state surfacesStart run, Booting, Console and Watch read real state; watch page from snapshots; releases per wave.
6. RefundsOps endpoint for full and pro-rata refunds; auto-cancel timers for 60 days unfunded and 14 days unstarted.
7. Deferred on purposeBacker votes, Stripe Identity, categories beyond games, Twitch.

Tests that matter