OrderCraft

A visual builder for transaction-ordering policies, with a simulator that replays a policy on real Solana slots and shows what it did to the block.

You compose a policy from a few primitives (speed bump, batch auction, allow/deny), run it on a recorded mainnet slot, and see two orderings side by side: the block as it was, and the block as it would have been under your policy — with the delay it added, the transactions it moved, dropped or deferred, and whether a marked sandwich triple survived.

What it is not. There is no integration with Jito BAM, and there will not be one — the plugin framework is closed. OrderCraft demonstrates a simulation, not production ordering. The right sentence for it is "here is what your policy would have done to this block", never "here is how you are protected".

Status: M2 — deployed and reachable from another computer

The kernel, the CLI and the four web screens run on a curated set of 53 real mainnet slots that live in this repository. The API, the Postgres schema and the shareable links are deployed: the application is at ordercraft1234.github.io/OrderCraft/app/, the page in front of it at ordercraft1234.github.io/OrderCraft, and it talks to https://ordercraft-api.onrender.com. Presets, batch runs and export are M3.

Idempotency is what this milestone had to prove, and it is proved across machines rather than inside one process: a run computed locally against the project's Postgres and the same run asked for through the deployed API come back with the same id — 0.71 s to compute it, 0.33 s to hand it back. A policy posted twice is stored once and keeps its address.

Lighthouse scores the published site 100 on performance, with the first screen interactive at 1.2 s on its mobile 3G profile against a 2 s budget. The first screen does not fetch the slot — 82 KB of bundle and nothing else — which is why it has room to spare; the half megabyte of block arrives only on the screens that show one.

The API runs on a free plan and sleeps after fifteen quiet minutes, so a first request after a long silence can take the better part of a minute. The screens that wait say why. A scheduled ping keeps it awake most of the time; it is a convenience, not a dependency.

The web app therefore has two modes, and neither is a degraded version of the other:

• Without VITE_API_URL it computes every run in the browser, on the slot the repository ships. Nothing is saved, there is no link, and the screens say so. This is what a clean clone does — measured at seventeen seconds from git clone to a reordered block, against a ten-minute budget, with no key, no database and no .env.
• With an address it saves the policy, asks the API for the run and hands back a link — #/p/<hash>/compare opens that policy's comparison on anyone's machine. A link is access: there is no sign-in and nothing here is private.

Both call the same kernel in the same order, so the figures do not depend on which answered. Measured on the demo policy and the shipped slot: moved 334 · delayed 4 · dropped 32 · deferred 26 · reordered 32.0 % · max 129 ms, identical either way.

Criterion	Budget	Measured	Where
SC-001 run time	slot ≤ 1,500 tx in < 3 s (p95)	p50 1.5 ms / p95 3.0 ms	packages/core/test/performance.test.ts
SC-002 determinism	50 repeats, 100 % identical	50/50 identical	packages/core/test/determinism.test.ts
SC-003 detector accuracy	recall ≥ 90 % on exhaustively labeled slots; false positives ≤ 5 % of what it reported	recall 0 of 1 — FAILED. 42 slots labeled exhaustively (271 leg pairs), one confirmed attack (445694841 #341/344, 3 of 3 blind labelers), and the detector is silent on it because the round trip closed at a loss. Precision is unmeasurable: nothing was reported	packages/fixtures/test/accuracy.test.ts
SC-004 anti-snipe breaks ≥ 95 % of marked triples	—	denominator is one marked triple; the detector does not report it, so the attack screen shows its empty state	same test

The gate is red on purpose. pnpm gate ends with 489 passed, 5 skipped and exactly one failure: accuracy.test.ts, "recall 0 of 1 marked attacks across 42 exhaustively checked slots". That failure is a measurement, not a broken build. Removing the detector's profitability check would give recall 1/1 at 13 % precision against a 5 % false-positive ceiling, so the rule stays as it is until the denominator grows. Do not soften the threshold or skip the test.

Quick start

Requirements: Node ≥ 22.18 (the CLI runs TypeScript directly, no build step) and pnpm 9. No RPC key is needed for the demo — the curated slots are in the repo.

pnpm install
pnpm dev          # web app on http://localhost:5173
pnpm gate         # biome check + typecheck + tests (red by design, see above)

That is the whole demo: no API address, no database, no RPC key. To run the API too, copy .env.example to .env, give it a DATABASE_URL and set VITE_API_URL to the API's address — one file at the repository root serves both halves.

Demo walkthrough (under 10 minutes from a clean clone):

This is the beginning of the README. Read the rest at the original. Read the full README ↗