Pocketful — a Purple-Team AI Dark Factory

Pocketful is a purple-team software factory: a band of four AI coding agents that builds a Venmo-style payments wallet and attacks its own work in the same loop — before anything is accepted. Payment systems don't fail on features; they fail on concurrency, retries, and rounding — double-spends and race conditions. So the factory is adversarial by design, with a strict split between who builds and who judges: - Architect — plans the work and writes the money invariants that must never break. Never writes feature code. - Builder — implements one unit at a time. Cannot mark its own work done. - Breaker — attacks every build with concurrency, replay, and boundary cases. Files reproducible exploits. Never approves. - Verifier — rebuilds from a clean, no-network container and independently re-runs every test before gating a stage as done. The mandates are generic — none mention payments — so the same band could build a different product unchanged. The wallet uses Python standard library only (runs offline), and money safety is enforced by the database: atomic transactions, integer cents, no floating-point money. It worked. The Breaker caught a real split-send bug where a response sent while the request body was still unread got reset by TCP, so the client got nothing. The Architect ruled it, the Builder fixed it, the Breaker hardened its suite, and the Verifier confirmed from a clean build. No human found that bug — the factory did. Stage 1 passed 152 attacks (normal + slow + Docker) from a clean build and was independently accepted. Built in BAND Desktop for the WeAreDevelopers x BAND Dark Factory hackathon.