Production System Blueprint
Saint Daniels Healthcare Rewards
A production healthcare equity platform that rewards verified health behavior with deterministic, geographically weighted incentives — settled through compliant financial rails and anchored for audit on a public blockchain.
One System of Record
The architectural invariant that governs every other decision: the PostgreSQL reward ledger running on Hetzner is the single system of record for every action verified, every point credited, every pool allocation, and every Participation Impact Score assignment.
Snowflake is a downstream analytics mirror. Polygon holds cryptographic commitments but never authoritative balance state. Circle executes payouts authorized by the off-chain ledger but never authorizes payouts independently. No component outside PostgreSQL can originate reward state, and no component inside PostgreSQL depends on an external system being available to remain consistent.
Six Horizontal Layers
The system is organized as a modular monolith during MVP with defined extraction points for later distribution.
Client Layer
Native iOS in Swift/SwiftUI as the primary surface, Android in Kotlin with Jetpack Compose, and a Next-generation web companion for account management, redemption flows, and the internal admin console.
Edge Layer
Caddy reverse proxy handles TLS 1.3 termination, HSTS enforcement, and request routing. Cloudflare sits in front at scale for DDoS protection and geographic distribution.
Application Layer
A thin HTTP boundary that delegates immediately to the domain service layer — UserService, VerificationService, RewardEngineService, RewardLedgerService, PoolAllocationService, AnchoringService, and SettlementService.
Data Layer
PostgreSQL 16 as the single system of record, Redis 7 for sessions, rate limiters, and BullMQ queues, and S3-compatible object storage for binary artifacts and archived audit logs.
Intelligence Layer
Snowflake with dedicated virtual warehouses for ETL ingestion, BI querying, and ML workloads — supporting equity modeling and cohort research without touching the operational hot path.
Integrity Layer
Polygon anchoring contracts and the Circle settlement API — both accessed outbound-only by their respective services and isolated from inbound traffic.
The Signature Innovation
Health Contribution Value Engine
The HCV engine computes a deterministic reward multiplier from regional population density, healthcare access, and outcome scarcity — amplifying rewards for users whose participation produces greater marginal public health impact.
Population Density (PD)
Persons per square kilometer at the Census tract level, sourced from the U.S. Census Bureau American Community Survey. Normalized inversely with logarithmic compression.
Healthcare Access (HAI)
A composite of primary-care providers per 10k residents, mean distance to qualified facilities, and preventive-care availability — sourced from HRSA AHRF and CMS provider enrollment data.
Outcome Scarcity (OSF)
A composite reflecting how far regional baseline outcomes fall below benchmarks — premature mortality, preventable hospitalizations, and chronic disease prevalence per County Health Rankings.
A Deterministic, Auditable Formula
Each input is normalized to the unit interval, then combined through a weighted linear combination:
RM = RMmin + HCV · (RMmax − RMmin)
Default weights are wPD=0.3, wHAI=0.4, wOSF=0.3, prioritizing healthcare access as the most direct indicator of systemic underservice. The multiplier is bounded between RMmin=1.0 (no user is ever penalized relative to the base schedule) and RMmax=2.5 (preserving economic sustainability).
Double-Entry Reward Ledger
Every point movement is recorded as a paired debit and credit with database-enforced invariants. Every transaction sums to zero. No entry is ever updated or deleted — corrections are implemented as compensating transactions, preserving complete history.
Application database users hold insert-only privileges on ledger tables. Update and delete privileges exist only for break-glass administrative accounts whose use generates audit alerts. Balances are never stored as mutable state — they are computed by aggregation.
Verified, Then Computed
Submissions pass syntactic, semantic, and evidentiary validation. Self-attested actions carry lower base rewards than externally verified actions — creating a steep gradient toward HealthKit, Health Connect, pharmacy claims, and provider feeds.
Pool-Funded Multipliers
Reward pools define a scope predicate, a funded amount, an allocation algorithm, and a time window. Funding sources include platform reserves, institutional grants, public-health partnerships, and content-neutral sponsor contributions.
Atomic Transactions
Each completion writes the action row, paired ledger entries, streak updates, milestone awards, and a domain event in a single PostgreSQL transaction. Any failure rolls back the entire change — no partial state ever escapes.
Cryptographic Integrity, Anchored Publicly
The integrity layer produces externally verifiable cryptographic evidence of off-chain ledger state — without compromising privacy or operational control.
Canonical Hashing
Every domain event is serialized into a strict canonical form, hashed with SHA-256 (FIPS 180-4), and chained to its predecessor in both per-user and global chains. Retroactive insertion or modification is structurally detectable.
Merkle Tree Anchoring
On a scheduled cadence — hourly during peak, daily otherwise — events are batched into a Merkle tree and the root is published to Polygon by the SaintDanielsAnchors contract. No tokens. No trading. Just commitment storage.
Public Verifiability
Any external party can request a Merkle proof for any event, recompute the root locally, and compare it against the on-chain commitment — proving inclusion under standard cryptographic assumptions.
Compliant USDC Settlement
Circle provides the rails for user redemptions and merchant payouts. Every Circle interaction is outbound-only and subordinate to the off-chain ledger as the authorization source.
Conversion happens only after KYC — government identity verification, biometric liveness, address verification, and sanctions/PEP screening through an integrated provider under a Business Associate Agreement. Idempotency keys derived from the settlement request ID guarantee that retries can never produce duplicate payouts.
Event-Driven by Design
The transactional outbox pattern guarantees every state change emits a durable event atomically — no event can ever be lost to a downstream failure.
Durable Event Log
Every service method that produces a state change inserts a row into domain_events within the same transaction. The log is partitioned by month, online for ninety days, archived indefinitely to object storage.
BullMQ Workers
Workers consume events with SELECT FOR UPDATE SKIP LOCKED for concurrent safety. Notifications, streaks, milestones, anchoring, settlement, and Snowflake replication all run as independent worker pools.
Replayable, Always
Any derived system — a Snowflake table, a notification history, even an entire Polygon anchor — can be rebuilt by iterating the event log with fresh consumer logic. No primary database restore required.
HIPAA, Finance, and Fairness
Saint Daniels operates at the intersection of healthcare privacy law, financial regulation, and state insurance law — and the security posture integrates all three regimes simultaneously.
LUKS at rest, pgcrypto column-level encryption for PHI with keys held in a separate key management service, TLS 1.3 in transit, mutual TLS within the server boundary, and immutable cryptographically chained audit logs replicated nightly to object storage with seven-year retention.
Scaled Only by Measured Demand
Every infrastructure transition is justified by a specific measured condition. No transition is performed speculatively.
MVP — 1k Users
A single Hetzner AX52 running the full Docker Compose stack. Closed beta over six months. Polygon anchored daily, Snowflake feeding initial dashboards, Circle settlement built but gated behind counsel review.
Growth — 10k
PostgreSQL extracts to a dedicated AX102 host with a read replica. Circle settlement opens to elevated-KYC users. The first institutional sponsored pools go live. Annual fairness audit published.
Scale — 100k
Load-balanced application hosts, dedicated Redis and worker hosts, RewardLedgerService and PoolAllocationService extracted to independent services. Multi-state expansion begins.
Global — 1M
AnchoringService and SettlementService extracted, GPU host introduced for ML verification, multi-region PostgreSQL with logical replication, currency-appropriate settlement rails where regulation permits.
Three Commitments, Continuously Enforced
Fairness is computed, not marketed. Integrity is verifiable, not asserted. Scale is earned, not anticipated.
Every reward traces to a specific verified behavior, weighted by a specific published fairness formula. Every commitment is anchored to a public ledger anyone can verify. Every infrastructure decision is governed by measured demand. The platform that results is one in which users in underserved and low-density regions receive amplified reward weighting — because their participation produces amplified public health value.