ProofGraph

Inspiration

Product discovery usually happens across chat, documents, spreadsheets, and whiteboards. The final idea survives, but the evidence, contradictions, assumptions, and reasons behind it are easily lost. That makes opportunity selection hard to audit and even harder to revise when an upstream fact changes.

What it does

ProofGraph is an evidence-native opportunity canvas. A builder starts with a goal and constraints, generates three distinct strategies, researches evidence, reviews source-backed claims, and creates structured opportunities with assumptions, risks, and cheap validation experiments. Every output is a typed graph node connected to its provenance.

Generation never mutates the authoritative canvas in the background. It streams durable progress over server-sent events and returns a reviewable graph patch. Patch application is transactional and idempotent. When a user edits an upstream node, affected descendants become visibly stale; explicit regeneration creates parallel successor branches so the original reasoning remains auditable.

The public demo requires no account. Each anonymous visitor receives an isolated clone of the canonical security-questionnaire scenario, a signed session, one-click reset, profile allowlisting, and PostgreSQL-backed session, concurrency, and global hybrid quotas. The primary demo profile uses deterministic planning/evidence with live GPT-5.6 synthesis and critique. A deterministic replay profile exercises the same pipeline and patch UI without a provider call.

How we built it

The application follows a three-component architecture:

• Django ASGI serves the API and built React client through Uvicorn and WhiteNoise.
• A separate Django worker claims durable PostgreSQL jobs with fenced leases.
• PostgreSQL stores graph state, immutable stage checkpoints, replayable events, patches, quotas, sessions, audit operations, and the worker queue.

React and TypeScript render the graph and patch review experience. SSE supports resumable progress from the last event sequence. Typed Pydantic contracts validate every provider stage. Public source ingestion blocks private-network targets and retains only derived, bounded excerpts—not full fetched documents. Production traffic enters through a Cloudflare named Tunnel; the origin is loopback-only and PostgreSQL has no public port.

Codex and GPT-5.6

Codex was the primary engineering environment used to translate the architecture into migrations, domain services, security boundaries, deterministic fixtures, tests, production containers, and acceptance workflows. The required feedback Session ID from the primary build task will be added before final submission.

GPT-5.6 powers live synthesis, critique, and patch construction in the hybrid demo. It also supported the internal blinded comparative benchmark. The official post-registration V2 run covered 20 scenarios, produced 80 complete outputs with zero partials, received 80 ratings from each of two independent judge personas, and passed all four required schema-3 dimensions. Only the sanitized aggregate result is public.

Challenges

The difficult work was not drawing nodes. It was preserving authority and auditability across long model calls: no external request inside a database transaction, no duplicate mutation after worker loss, no silent profile fallback, no stale reasoning presented as current, and no cross-session data access in an anonymous public demo. Deterministic replay also had to match semantic graph state after real patches removed fixture-only identifiers and advanced canvas revisions.

Accomplishments

• Reviewable, dependency-closed graph patches with transactional application.
• Replayable SSE, checkpoint resume, cancellation, retry, and fenced worker recovery.
• Source-backed claims, contradictions, lineage, visible staleness, and parallel regeneration.
• Anonymous isolation, reset, CSRF, secure cookies, profile restrictions, and durable cost controls.
• A fresh, pre-registered V2 benchmark that passed all required dimensions.
• A zero-subscription public architecture using Docker and a stable Cloudflare named Tunnel.

What we learned

AI product quality depends as much on state and evidence contracts as on prompts. Durable checkpoints make recovery testable; explicit patches keep the user authoritative; provenance turns model output into inspectable reasoning; and a frozen benchmark prevents a weak result from being redefined after it is observed.

What's next

Next steps are broader real-user validation, additional redistributable scenario bundles, stronger operator monitoring, and evaluation of semantic retrieval only if explicit graph neighborhoods prove insufficient. Replacement regeneration, full-document retention, autonomous legal/security review, and paid multi-region hosting remain intentionally outside this MVP.

Built With

• cloudflare-tunnel
• codex
• django
• docker
• openai-gpt-5.6
• postgresql
• react
• server-sent-events
• typescript
• uvicorn