Devpost Build Story — Iteration 3: Auditable DWS Pipeline

Inspiration

High-value resale has no shortage of listings; it lacks a safe way to understand the evidence behind them. A buyer may receive a receipt, order document, and product photos, but each piece is fragmented and may contain sensitive personal information. Rewear Verified turns that seller-provided evidence into a private, source-linked Passport draft for human review.

Rewear Verified verifies provided evidence consistency, not product authenticity.

What it does

A seller creates an Item, uploads a purchase document and product image, and starts an asynchronous analysis Job. The system extracts allowlisted fields with provenance, protects privacy, matches the surviving evidence deterministically, and creates an owner-only DRAFT Passport. Evidence quality is expressed only as STRONG, MODERATE, LIMITED, or INCONCLUSIVE.

Nutrient DWS Data Extraction performs schema-constrained extraction with region-bounded source citations on the correct page for the receipt and product image; Rewear then enforces privacy, matches the evidence, and generates a Passport draft that makes no authenticity determination.

How we built it

The application is a modular monolith using Vue 3, FastAPI, PostgreSQL, Redis/Celery, and private MinIO storage. A DocumentUnderstandingProvider boundary keeps the offline, deterministic Mock baseline separate from the competition Sponsor mode.

In Sponsor mode the Worker is the only service that receives the Nutrient credential. It admits only the committed synthetic Fixture hashes, makes two DWS extraction calls, caps and validates the untrusted responses, requires a closed category vocabulary and grounded citations, and binds every promoted claim and privacy region to the immutable synthetic Fixture contract. It performs no automatic retry. DWS does not choose the Passport quality; Rewear's deterministic matcher does.

Challenges

The hardest problem was preserving trust while using probabilistic document understanding. An extracted value is not accepted merely because a Provider returned it. Receipt facts fail closed when grounding is missing, partial image observations are withheld, privacy detection must cover every submitted input, and AuditLog stays payload-free. A MODERATE result is therefore deliberate evidence restraint, not a failed demo.

Accomplishments

• A complete private SaaS flow from registration through Passport display.
• Real Nutrient DWS extraction in the core document-processing path.
• Safe Provider provenance shown through the existing Job contract.
• A directly observed successful Sponsor Job, protected privacy state, and six-fact private Passport; lower-level Claim/privacy counts are contract-derived because the final aggregate capture lost its remote Docker stdout.
• A five-stage auditable trust pipeline with a private human-review checkpoint.
• 243 backend tests and 58 frontend tests passed during Iteration 3 implementation, together with lint, typing, migration, OpenAPI, and production-build checks.
• Release gates bind source packaging and local acceptance to the final candidate while preserving the no-retry Sponsor record at its successful-path baseline commit.

What we learned

Trustworthy AI engineering is less about adding another model and more about narrowing authority. The Provider may understand a document, but application-owned contracts must decide what can leave private storage, what can persist, what counts as evidence, and what must be withheld.

What's next

The same Provider and workflow boundaries can support controlled platform API integrations, stronger operational reliability, and explicit human-review tooling. Public Passports, marketplace features, payments, recommendations, and arbitrary user evidence egress are intentionally outside this competition release.

Demo and source

• Video: 2:50, English narration with burned-in English captions.
• Source: the release process generates it from the final committed Git tree with git archive.
• Exact commit and SHA-256 values are published from the uploaded package manifest as the single source of truth after the final acceptance run.

Built With

• artificial-intelligence
• celery
• docker
• fastapi
• minio
• nutrient-dws
• playwright
• postgresql
• pydantic
• python
• redis
• sqlalchemy
• typescript
• vue.js