LT SmartTender

Evidence-backed AI procurement decisions for global tenders, launching with US and EU sources and expanding to the UK, Canada, and Singapore.

Comment

posted an update —

Milestone 4 — Auditable agent runs and human review

LT Tender Trace now has a durable, least-privilege record of every bounded AI run while keeping detailed operational traces private.

Completed

  • Applied six live Supabase migrations for tenant-visible agent-run summaries and private append-only step traces.
  • Enforced the fixed routes: gemini-3.1-flash-lite for triage and gemini-3.5-flash for decisions and reevaluations.
  • Recorded configured and actual model IDs, routing reason, prompt/schema version, token use, latency, cost, validation outcome, correlation ID, and idempotency key.
  • Rejected prompts, raw payloads, credentials, document text, reasoning content, and chain-of-thought keys at every nested trace-summary level.
  • Made run identity and routing metadata immutable and blocked every update after a run reaches a terminal state.
  • Limited browser users to read-only summaries for their active organization. Detailed steps remain private and service-only.
  • Added a typed human-review panel with pending, accepted, and overridden states. Override requires a trimmed nonblank reason; completed reviews are read-only.

Verified evidence

  • Live rolled-back checks proved active-member visibility, outsider isolation, authenticated and anonymous write denial, private-step denial, service-only RPC execution, fixed-model enforcement, redaction enforcement, and terminal immutability.
  • The Supabase security advisor reports zero findings, and the new composite foreign key has a covering index.
  • Lint, TypeScript checking, 115 automated tests across 21 files, and the Next.js production build pass.
  • The verified checkpoint is GitHub commit ce04d25.

Still pending

Live Gemini execution requires the server API credential. SAM.gov live validation requires its API key. Google and Microsoft sign-in require provider-console configuration and clean-browser verification. Server-side persistence for human accept and override actions remains in progress. None of these items is represented as complete.

Next milestone

Run a live TED notice through both configured Gemini roles, bind every output citation to the immutable source version, persist the completed run, connect the human-review action to append-only audit storage, and begin the expert-labeled US and EU golden-set evaluation.

Log in or sign up for Devpost to join the conversation.