ProofFlow

Inspiration

Hackathon teams lose time at the last mile: binding rules, sponsor requirements, repository evidence, deployment proof, and video requirements live in different places. A generic chatbot can summarize them, but it does not prove what is actually satisfied. ProofFlow turns that messy review into one bounded, auditable workflow.

What it does

ProofFlow is an autonomous submission-compliance agent. Given an official Devpost rules page, a public GitHub repository, and an optional live deployment, it:

1. validates, reads, and SHA-256 fingerprints the binding rules;
2. inspects the repository tree and README through GitHub's public API;
3. probes the deployment for live reachability;
4. asks Gemini for schema-constrained requirement-to-evidence reasoning;
5. validates the result again with Zod;
6. asks Gemma 4 to select one existing validated action through a forced function call;
7. uses Gemini Embedding 2 to measure that action against the validated risk list;
8. persists an immutable evidence ledger in Cloud Firestore; and
9. produces a downloadable, source-cited Markdown action pack.

This is a complete workflow, not a chat loop: the agent collects sources, performs checks, records state, and creates the handoff artifact autonomously. Missing evidence remains explicitly missing.

How I built it

• Gemini 3.6 Flash through Google's official GenAI SDK (@google/genai), with Gemini 3.5 Flash Lite as an availability fallback. The public showcase run was produced by the compliant 3.5 fallback.
• Gemma 4 26B through the same SDK for the operational handoff. Gemma must call select_next_action with an index from the already validated action list; it cannot invent or rewrite the action.
• Gemini Embedding 2 through the same SDK for a 128-dimensional semantic-grounding check. It records the closest validated risk and cosine score without rewriting the audit or priority.
• Cloud Firestore in the proofflow-agent Firebase project for audit ledgers, server-side capacity counters, and health evidence.
• Next.js 16, React 19, TypeScript, Zod, and Vitest.
• Strict URL allowlists, bounded fetch sizes and timeouts, prompt-injection boundaries, schema validation, pseudonymous rate limiting, and server-only credentials.

The data sources are the contest's official Devpost rules, GitHub's public repository API, and the supplied public deployment URL. No browser client receives the Gemini API key or Firebase service-account credential.

Google Cloud proof

The public health endpoint performs a server-authenticated Firestore write before returning "firestore":"connected". Audit records are then read back from Firestore to generate both the live 95/100 JSON ledger and its downloadable evidence pack. That immutable record exposes the successful Gemma 4 model ID, function-bound action, rationale, Gemini Embedding 2 score and matched risk, and six-step action log. A separate 96/100 primary-model run preserves successful Gemini 3.6 Flash provenance.

Challenges I ran into

Gemini capacity spikes required a bounded fallback rather than an unbounded retry loop. Evidence pages also contain untrusted prose, so ProofFlow treats source text as data, constrains the primary model output to JSON Schema, and revalidates it before persistence. Gemma then receives only validated risks and actions; an invalid index or unavailable response falls back deterministically without weakening the core audit. The optional embedding stage is similarly fail-safe: it may measure alignment but cannot rewrite the validated decision. Finally, deployment proof had to be independently testable without exposing cloud credentials.

Accomplishments that I'm proud of

• A reproducible public workflow with no login required for judges.
• A passing external production trace that persisted a 95/100 audit with Gemma 4 selection and Gemini Embedding 2 grounding at 0.7463 cosine similarity to an exact validated risk.
• Separate immutable records proving the primary Gemini 3.6 path and the Gemini 3.5 availability fallback.
• Live Firestore-backed persistence and downloadable evidence packs.
• 28 passing automated tests, lint, and a clean production build.
• A clear architecture diagram, cloud proof, and build provenance.

What I learned

Agentic systems become more trustworthy when every model judgment is attached to deterministic source evidence, durable state, and a concrete next action. Fast failure with an explicit status is more useful than optimistic prose.

What's next for ProofFlow

Keep the public deployment and evidence links stable through judging, expand the bounded source adapters, and add team workflows that turn each missing requirement into an assigned, traceable action.

Build-period disclosure

ProofFlow was built from scratch on August 5, 2026, after the contest opened on August 3. No pre-existing project code was incorporated; standard open-source frameworks and dependencies are declared in package.json. The public demo was created for the purpose of entering the All Things Agentic Hackathon in the Taskmaster category.

Built With

• ai-agent
• devpost
• embeddings
• firestore
• gemini
• gemini-embedding-2
• gemma
• google-genai-sdk
• nextjs
• typescript