Layer 01 · Direct technical engineering
Fabrik7 didn't sponsor the Cup. It is the Cup in Itapetininga.
Palpiteiros is the platform that turns every table into a team. Built by the ATUO group, with engineering live from the first QR.
An on-premise activation where showing up scores points, real prizes come back as brand vouchers, and the player only feels the game. The engineering disappears.
What was at stake
Real prize, real brand, 38 days to get it right.
Fabrik7 didn't want to sponsor the Cup. It wanted to be where the Cup happens in Itapetininga. That required an activation that worked from the first QR scan to the last voucher handed out. No dispute, no friction, no technical excuse.
A single visible bug during the Cup would cost hours of public pressure: at the table, on Instagram, in word of mouth. The platform offline on a Brazil game day would become a brand event, not a technical incident.
Engineering had to disappear. For the player, only the game.
The table experience
Scan the QR. Step into the house's Cup.
No app to download, no password to create, no card to register. Walk in, sit down — and the Cup starts in you.
- 01
At the door
You arrived at Fabrik7 and picked a table. Every table has its own QR Code.
- 02
First scan
The digital menu opens, with an "Enter Palpiteiros" button. Identity comes from Odoo — no login, no sign-up.
- 03
Blocking onboarding
Choose attack team, defense team, star player, favorite underdog. Predict every match of the current stage. Without that, you don't enter the competition.
- 04
During the Cup
Follow scores in real time, watch the live ranking, feel each goal hit your choices. Checking in on Brazil game nights becomes a bonus.
- 05
When the tournament ends
Prizes are Fabrik7 vouchers. Whoever wins comes back. The Cup ends; the relationship with the brand doesn't.
It's the house turning into HQ. The Cup doesn't happen at the stadium or on TV. It happens at the table.
ATUO ecosystem in action
Each layer of the group in its own area. In arrangement, with no artificial border.
Palpiteiros is a group project. Strategy, product, engineering and physical operation — each with clear responsibility and direct ownership.
ATUO.agency
Strategy · Narrative · Rulebook
Activation concept, naming, dedicated rulebook with 37 clauses and 14 numbered scoring rules, positioning and in-venue communication.
ATUO.digital
Product · Design · Experience
Product design, Palpiteiros visual identity, blocking-onboarding UX, live picking flow and the on-premise table experience.
Code and Soul
Engineering · Platform · Operations
Serverless architecture, 25 Lambdas, 21 DynamoDB tables, WebSocket, scoring engine, immutable ledger, end-to-end simulator, security gate and operations during the Cup.
Fabrik7 Brewing & Co
Client · Venue · Odoo POS
The venue where the activation happens. The Odoo digital menu emits the per-table session token, sustains the unique partner_id and backs the voucher prizes.
Impacto
What Fabrik7 walks away with.
A platform of its own for the activation, running the entire tournament, recording every pick with a full audit trail, and paying out prizes without dispute. All within a short window and at controlled cost.
25
Lambdas in production with 30+ admin endpoints
21
DynamoDB tables with PITR and pre-Cup snapshots
3h50
Full Cup simulated before the first kickoff
6
Critical bugs caught in the simulator before production
Como abordamos
How we built it.
Six architecture decisions that became the project standard.
On-premise first
Session token bound to the table, not the device. Leave the venue, lose the session in 15 minutes. Checking in at the bar becomes a scoring rule (§14).
Immutable ledger and audit trail
Deterministic sort key per match+rule: rescore overwrites, never duplicates. picks-history is append-only. Every rejected attempt is logged with IP and User-Agent. Every staff action lands in admin-audit.
Embedded anti-fraud
Score-repetition limit blocks "1-0 across the board" entries. Per-match lock 15 min before kickoff. Blocking onboarding for late joiners. Single account per partner_id, tied to Odoo.
Real-cascade knockout bracket
The 32 knockout matches only appear once the 72 group games are over. Virtual teams (winner-r32-1) become real at the right moment. No blind predictions.
End-to-end simulator
Mirror environment on the same SAM stack. A match-simulator produces synthetic events. A bot-palpiteiros plays for bot accounts. The full Cup (104 matches) ran in 3h50 of real time and surfaced six bugs before production.
Serverless that scales up and down
25 Python 3.12 arm64 Lambdas. HTTP API + WebSocket. 21 DynamoDB tables with PITR. SAM in nested stacks. Daily Cost Anomaly Detection. Cup peak absorbed on-demand. Zero residual cost when the tournament ends.
Architecture
The system in one image.
Table, Odoo, CDN, API, real-time, compute, data and ingestion. Each layer with clear responsibility — and nothing idle when the Cup ends.
What we learned
Five things we only learned by building this.
A good platform doesn't come from the diagram. It comes from every bug caught before production. These five became project policy.
Silent drift on a nested API Gateway stack
Causa raiz
The parent stack didn't detect drift when resources of the nested stack were deleted. Four routes disappeared without warning. detect-stack-drift on the parent returned IN_SYNC even with everything already out of place.
O que fizemos
A CloudWatch alarm monitoring the API Gateway route count. New rule: run drift detection on the nested stack, not the parent.
DynamoDB Decimal turning into a string on the front-end
Causa raiz
`json.dumps(default=str)` serializes Decimal as a string. When the front-end runs `Number()`, the string slips through. Accumulated score became concatenation ("2"+"3" = "23"), not a sum.
O que fizemos
Custom encoder that converts Decimal to int/float before serializing. Now project standard. Every new Lambda inherits it.
The simulator looks like a luxury until the first production bug
Causa raiz
Race conditions in knockout_trigger when real kickoffs overwrote the simulator's time compression. UX edge cases in the blocking onboarding. All things that only surface with 104 matches running.
O que fizemos
sim.palpiteiros as a mirror environment on the same SAM stack. Match-simulator + bot-palpiteiros. The full Cup in 3h50 before the first real kickoff. Six critical bugs caught.
Write-once and force majeure don't mix without a clause
Causa raiz
A strict no-edit-after-lock policy protected integrity but burned trust when a player was officially cut from the Cup. The user lost points for something out of their control.
O que fizemos
Clause §13.1 in the rulebook plus a manual admin procedure for re-picks under force majeure. Full audit trail in admin-audit. Integrity preserved, relationship preserved.
CORS preflight blocking a JWT-protected route
Causa raiz
Browser rejects OPTIONS when the handler requires Authorization. Even with global CorsConfiguration on the API Gateway, the preflight hits the JWT authorizer and dies.
O que fizemos
Standalone OPTIONS route without auth for every protected endpoint. Project template default. Every new extension includes OPTIONS by default.
What this means
We build the platform. You run the campaign.
This case isn't about the World Cup. It's about what happens when engineering shows up before the campaign: the product stands without you having to think about it.
For anyone planning an on-premise activation, a short-window campaign or an event-driven platform that will run two months and shut down, this case is the evidence that there's a way to make it production, not improvisation.
Engineering first. So the campaign happens.
Conexões
Where this case connects within the ATUO group.
Got an on-premise activation or event-driven platform on the table?
If your product needs to scale within a short window, with integrity and controlled cost, a direct technical conversation is worth it.
Engenharia não é decoração. É direção.