CaptureOS

COS Log-in
COS User Questionnaire
COS Loading Screen
COS Results
COS Homepage
COS Agent
COS Loans
COS Tax Organizer
COS Log-in
COS Logo

Inspiration

The US government gives out hundreds of billions of dollars a year to small businesses. These opportunities include federal contracts, grants, SBA loans, SBIR/STTR awards, R&D and hiring tax credits, which set aside advantages for certified businesses. Almost none of it gets claimed by the businesses who actually qualify, not because they're ineligible, but because the process to prove eligibility is scattered across a dozen government portals, buried in the FAR and CFR, and gated by paperwork most small business owners can't afford a consultant to navigate.

What it does

CaptureOS turns a small business's minimal inputs into a filing-ready, source-backed package for government contracts and grants that are discovered, researched, requirement-extracted, evidence-matched, scored, and assembled. At the end of this process is a human approving anything consequential and a complete, exportable audit trail. Every claim is cited to a real, retrievable regulatory source, and nothing is ever auto-submitted.

How we built it

FastAPI + async SQLAlchemy on the backend, Next.js 16 App Router + TypeScript on the frontend, Postgres with pgvector for the RAG grounding layer. The core architectural decision was a provider-seam design. Every external dependency (the LLM, embeddings, storage, billing) sits behind a swappable interface with a working mock, so the whole system runs and demos with zero cloud credentials, then flips to real providers via a config change with no code change. Gemini powers both the reasoning agents and the embeddings. Citations aren't a prompt instruction; they're enforced in code. An agent's output is schema-validated against a real Pydantic model, and if the model doesn't return a resolvable citation, it gets automatically rejected and retried.

Challenges we ran into

Most of the real challenges were the unglamorous kind that don't show up in a demo, but matter in production. A local Postgres port conflict turned out to trace back to a native database service silently shadowing the one our app expected. Diagnosing it meant tracing actual TCP connections, not just restarting things and hoping. A background AI agent crashed the app in production because its output schema allowed any string for a status field instead of the two valid values, so the model occasionally returned something reasonable but technically unexpected, and nothing caught it until it reached the browser. Fixing it meant tightening the actual type contract, not just patching the symptom. We also hit a subtle race condition: a form-prefill feature that, under the right timing, could silently overwrite a user's in-progress edit with stale data.

Accomplishments that we're proud of

Getting the whole system running end-to-end with zero cloud credentials sits behind a swappable interface with a real working mock. The entire product demos offline and then flips to real providers with a config change, not a rewrite.

We're also proud of repairing what didn't make it into the demo: four separate bugs found during testing, including a production crash traced all the way back to an LLM being able to return a value our schema never actually constrained. Each one got a real fix at the source, verified against the full test suite, not a quick workaround. The full suite stayed green through the entire night of active feature wok.

Every claim this product makes is cited to a retrievable source, checked in code, not just requested in a prompt. Nothing is ever auto-submitted since a human approves before anything real happens. This isn't just a marketing line; this is an enforced guarantee, and building them in from the start rather than bolting them on later is the part we're most proud of.

What we learned

The biggest lesson wasn't really about a specific application. It actually was that a schema is only as protective as what it actually constrains. The Copilot crash happened because a field was typed as a plain string with a comment saying "should be ____" which reads fine in code review, but means nothing to an LLM generating structured output at runtime. The fix wasn't a patch; it was going back and making the schema itself enforce the guarantee instead of just documenting it. Distinguishing a rule that's currently enforced versus a rule that's hoped for turned out to be the crux of almost every real bug we hit. We also learned that the local-first, cloud-ready architecture decision made early on actually paid for itself. This has enabled us to swap database backends, point at a real cloud Postgres instance, and deploy without touching a line of application. It's the reason deployment took under an hour instead of a rewrite. For security measures, rate limiting is easy to deprioritize when there are no users yet, but the actual threat model doesn't check your user count, it checks whether your login endpoint is reachable on the internet at all.

What's next for CaptureOS

Short term: our plan is to finish the RAG corpus embedding so Copilot answers are grounded in the real regulatory text instead of running on the deterministic catalog alone, wiring up live SAM.gov contract data, and closing the gap on real billing so the paid tiers are more than a mock flow.

Longer term: the plan is deliberately narrow then wide. CaptureOS will start with a focused beachhead, such as WOSB, SDVOSB, HUBZone, and 8(a) certified small businesses, a segment with real, recurring compliance deadlines and genuine whitespace in who's actually serving them and prove the model hands-on with a handful of real businesses before opening it up to self-serve. From there, the same underlying engine (cited, human-approved, audit-trailed compliance automation) extends into SBIR/STTR and the broader small-business government-money landscape. The wedge is finding money a business is owed, and the actual moat is being the system of record for the paperwork that keeps it owed year after year.