Inspiration
When I build with AI coding tools, the finished code usually survives, but the evidence behind it does not. Decisions are buried in chat, generated summaries lose their sources, and another person cannot easily tell what was verified. I built Panurgic Flow as the signed release-evidence layer for AI-assisted software: the missing final step between completed agent work and a release record another person can inspect. It preserves that record without forcing developers to install a git hook, upload private project material, or trust a hidden scoring system.
What I built
Panurgic Flow is a local-first provenance workspace for AI-assisted development. It accepts evidence from Codex or a mixed-agent workflow, previews recognized and unrecognized lines, and turns the supplied record into a versioned evidence packet.
The workflow has three stages. Capture normalizes repository activity, test results, Codex notes, human decisions, and reusable patterns. Review creates a manifest and a claim-to-source ledger where each claim is labeled Grounded or Review. Export produces four artifacts: an implementation summary, stakeholder walkthrough, verification runbook, and Codex workflow skill.
Projects and recent packet versions stay in IndexedDB on the current device. The app falls back to session memory when persistent storage is unavailable. A checksum uses deterministic canonical JSON and SHA-256, while approved packets use ECDSA P-256 with a non-extractable device key. Re-import distinguishes Signature valid, Checksum matched, Unsigned, and Modified states instead of presenting a checksum as signer identity.
The repository also publishes a machine-readable release-claims artifact. A locked GitHub Actions workflow runs installation, dry-forge validation, lint, tests, production build, secret scanning, and claim-contract validation before GitHub OIDC and Sigstore provenance is attached to that exact file. Anyone can independently verify the repository, workflow, commit, and artifact digest with GitHub CLI attestation verification.
Codex and GPT-5.6
Codex was my primary implementation partner for the architecture, interface refactor, deterministic contract, tests, accessibility checks, security hardening, documentation, and deployment preparation. I chose the product problem, Developer Tools audience, Panurgic Flow name, local/public trust boundary, evidence policy, artifact set, and the final claims that can be shared.
As of the July 21 pre-submission audit, the primary Codex task records at least 7.4 hours of completed Codex execution across 32 turns within a 69.5-hour elapsed build window. Human planning, review, recording, and upload time are not instrumented, so I have not invented or added them to the active-hours figure.
The optional trusted companion uses @openai/codex-sdk with gpt-5.6-sol. It accepts a bounded forge request and returns structured PanurgicPacketV1 output under a read-only sandbox with approvals denied and network access and web search disabled. Its child environment is reduced through an allowlist and its working directory is an isolated temporary directory. The public website does not run the model, expose an API key, or provide a hosted generation endpoint.
During final verification, a fresh authenticated run produced a valid V1 packet with three traceable claims, two risks, a three-step verification checklist, and all four current artifacts. The imported packet identifies its source as codex-sdk ยท gpt-5.6-sol.
What I learned
The most important boundary is that cryptographic integrity is not semantic truth. A valid ECDSA signature proves private-key control and unchanged packet bytes. The fingerprint identifies a person only after it is compared through an independent trusted channel, and neither a signature nor a checksum proves that the original evidence was accurate. Panurgic Flow therefore keeps exact sources visible, blocks signing while claims remain in Review, publishes reproducible tests, and states these limitations beside the proof.
Built With
- cloudflare-workers
- codex-sdk
- gpt-5.6
- next.js
- openai-codex
- openai-sites
- react
- typescript
