Attest — proof a human understood this

Inspiration

AI broke assessment. An essay used to prove there was a mind behind it; now it proves nothing. Schools responded in two failing ways: banning AI, which is unenforceable, and buying AI detectors, which are snake oil — they falsely accuse honest students, collapse under a light paraphrase, and turn teachers into police nobody trusts.

We think the question itself is wrong. "Did a human make this?" no longer has a reliable answer. The question that still works is the one great examiners have always asked: can a human stand behind this?

What it does

Attest turns any written assignment into a short, adaptive oral defense.

1 · Capture. A light editor records writing as it happens — every keystroke, pause, and paste — as an append-only event log. Each event is a single edit $e=(t,\,p,\,\text{ins},\,d,\,\pi)$: a timestamp, a position, inserted text, a delete count, and whether it arrived by paste.

2 · Provenance. Replay is a fold over that log, so the document at any instant $\tau$ is

$$T(\tau)\;=\;\underset{{\,e_i\,:\,t_i\le\tau\,}}{\mathrm{fold}}\ \mathrm{apply},\qquad \mathrm{apply}(s,e)\;=\;s_{[0,\,p)}\;+\;\text{ins}\;+\;s_{[\,p+d,\;|s|)}$$

We carry an origin record alongside the text, so every surviving character $c$ knows its birth time $\beta(c)$ and paste flag $\pi(c)$. For a paragraph $\sigma$, the set of distinct birth moments is

$$B(\sigma)={\,\beta(c)\;:\;c\in\sigma\,}$$

and a paragraph arrived whole exactly when

$$\text{pastedWhole}(\sigma)\iff |B(\sigma)|=1\ \ \wedge\ \ \forall c\in\sigma:\ \pi(c)$$

A pasted paragraph has $|B(\sigma)|=1$. Hand-written prose has $|B(\sigma)|$ in the hundreds. This is computed, never guessed, so the evidence is auditable.

3 · Seam. GPT-5.6 reads the essay plus a plain-language account of how it was written, and finds the seam — the claim the writer is least able to defend. Provenance is a hint, not a verdict: a pasted quotation someone can explain is not a seam; a hand-typed paragraph they parroted is.

4 · Defense. An examiner probes that claim in a live voice conversation over WebRTC, following up the way a sharp examiner does. You can paste an essay you didn't write. You cannot defend one.

5 · Remediation. When a gap opens, the examiner stops examining and starts teaching — Socratically, until the student can defend the point — then asks again. Getting there with help still counts, and the card says so.

6 · The card. A scannable summary: what held up, what needed teaching, the transcript. It never accuses. It surfaces evidence and closes gaps, and leaves the judgment to a person.

For teachers, it runs the other way too: point Attest at any assignment and it rewrites it to survive AI — demanding the student's own reasoning and their own examples — and generates the oral-defense rubric to grade it with. Every defense rolls up into a class view: a live map of genuine understanding, not a list of who got flagged.

How we built it

One examiner, many mouths. The examiner's value is its reasoning — holding a hypothesis about what a student understands and updating it every turn. Whether that reaches the student as Realtime audio, browser speech, or text is a thin adapter over one shared core: one prompt, one tool schema, one verdict fold. Adding a transport costs hours, not days.

Deterministic evidence, model judgment. Paste runs and revision counts are plain TypeScript. The model reasons over facts; it never invents them. That split is what lets Attest show its work instead of asking to be trusted.

Character provenance. Events record positions in the evolving text, but seams live in the final text, and positions shift as the writer edits. Rather than approximate a mapping, we carry provenance through the replay — so the finished essay knows exactly how each character came to exist.

Stack

Next.js 16 (App Router) on Vercel
GPT-5.6 via the Responses API — structured outputs, function calling, tuned reasoning effort
OpenAI Realtime API over WebRTC — server-minted ephemeral tokens, semantic VAD, tool calls on the data channel
Web Speech API as a keyless voice fallback
Neon serverless Postgres for classes, assignments, rosters
Vitest (60 unit tests) and Playwright for E2E
A dependency-free token-bucket rate limiter: $\text{tokens}\leftarrow\min!\left(C,\ \text{tokens}+\Delta t\cdot\tfrac{C}{W}\right)$

Challenges we ran into

The live voice path can't be unit-tested. A microphone and a WebRTC handshake aren't mockable, so we built it to fail in the open: visible connection state, event names matched against every known GA variant, and a watchdog that drops to text if the examiner ever goes silent.

Two bugs only surfaced against the live API. The Realtime session rejects the strict field that the Responses API requires — sharing one tool schema silently killed every voice session. And the session endpoint was refusing tokens for documents with no database row, which is exactly the case for demo fixtures and unsynced drafts.

Making it testable without credentials. Judges shouldn't need an API key. Attest auto-degrades: with a key it's the real product; without one, a deterministic examiner walks the identical probe → flag → teach → re-ask loop. The instance always reports which brain is answering — the two are never presented as the same thing.

Keeping the evidence honest. Every decision was checked against one rule: never accuse. The process evidence is teacher-facing only — there's a test asserting the student never hears the word "paste."

Accomplishments that we're proud of

A defense that genuinely corners you. Ask GPT-5.6 for a breaking case — "what would have to be true for this claim to fail?" — and a bluff has nowhere to go.
The replay. Two essays with byte-identical text and opposite histories on one timeline. The argument lands in two seconds with no narration.
It closes the loop. Attest doesn't lower a score and walk away; it teaches until the gap is closed, then re-checks. Assessment and instruction become one act.
It works with no key, no account, and no database — anyone can walk the whole product for free.

What we learned

Provenance is a weaker signal than it looks, and understanding is a stronger one. Process capture is gameable — you can retype an AI essay — which is exactly why the defense is the moat and the capture is only a map of where to look.

The seam is provenance-agnostic. It exists in a hand-written essay by someone who memorised without understanding, precisely as it exists in a pasted one. Hunting the seam instead of hunting AI sidesteps the detector arms race entirely and solves a strictly larger problem.

What's next for Attest — proof a human understood this

A portable credential. Every defended piece mints a verifiable record — a transcript of defended competencies instead of grades.
Hiring, inverted. Verify that a candidate actually understands their take-home, instead of screening resumes nobody trusts.
The compounding-learning metric. Because every failed defense triggers a micro-lesson and a re-defense, Attest can measure defensibility rising over time — showing learning happen, week by week. No edtech product can currently produce that number.
Beyond essays: code (defend your commit history), math (defend each proof step), lab reports, design.

Detectors ask "did a human make this?" Attest asks "can a human stand behind this?" — and then makes them able to.