RUNTIME TRACE

Architecture

The runtime is intentionally small. A shared assembly load balancer accepts public TCP traffic on port 9999, chooses an API worker, and transfers the accepted client file descriptor over a Unix socket using SCM_RIGHTS.

The API workers are the scoring boundary. They parse HTTP and fraud fields directly from inherited client descriptors, then respond on the same descriptor. The load balancer only routes descriptors and never inspects fraud payloads.

Compose keeps the contest envelope explicit: LB 0.06 CPU / 30M, api1 0.47 CPU / 160M, and api2 0.47 CPU / 160M. The LB runs in fdpass stream mode with a 262144 send buffer and two upstream Unix sockets.

The heuristic is source-backed rather than corpus-backed. It considers amount, installments, customer velocity, amount ratios, MCC risk, known merchant state, online/card-present hints, and distance fields, then maps the capped fraud count into public buckets 0.0, 0.2, 0.4, 0.6, or 1.0.