ThreatWatch Studio

Inspiration

Every morning in intelligence work started with a brief. Someone had read everything overnight and could tell you what mattered, what was solid, and what was still a judgment. Most teams never get that support. They increasingly get AI summaries instead, but those summaries rarely show which sentence came from a source and which one came from the model.

I had previously built a personal daily-brief script that flagged modeled numbers. During Build Week, I wanted to find out whether that small discipline could become a complete product: an executive brief that earns trust by letting the reader fact-check it as they go.

What it does

ThreatWatch Studio turns open-source reporting about a fast-moving risk into an inspectable executive brief.

Choose one of four seeded scenarios: Strait of Hormuz, Taiwan Strait, Gulf Coast hurricane season, or the Play ransomware campaign. ThreatWatch shows the evidence pipeline before the answer. Every retained source has a stated reason, and discarded material stays visible with the reason it failed. From there, the product drafts a BLUF-style brief while preserving the boundary between sourced fact and analytic judgment.

The centerpiece is Inspect a claim. Click any underlined sourced statement to open the exact excerpt, source date, retrieval metadata, and original document. Click any MODELED label to see the method, confidence, probability language, relevant base rate, and a plain warning that the judgment is an inference, not a sourced fact.

The product also makes recency and audience explicit. Date-window controls distinguish what changed from the standing situation and label any fallback to the checked-in snapshot.

The recorded video shows an evidence window ending 17 July 2026. The Strait of Hormuz situation changed after that date, and the live site has been corrected to reflect it. The video predates that correction. Four audience profiles re-cut the same evidence for an analyst, domestic insurer, international travel operator, or logistics and shipping team. The repository contains 16 verified GPT-5.6 captures across the four scenarios and four profiles, each with its own response ID, request ID, resolved model, timestamp, and token usage.

A desk-curated watchboard gives official-source headlines the same evidence treatment. A governance assurance layer maps visible product behaviors to the free NIST AI Risk Management Framework and NIST AI 600-1 Generative AI Profile. The UI calls this a self-assessed mapping, not a certification, endorsement, or legal conclusion.

How we built it

Codex built the majority of the core application during Build Week in one primary task. It translated my tradecraft brief into the data model and three-screen product flow, built the evidence and methodology drawers, implemented the server-side analysis route, created the deterministic fixtures, added tests and setup guidance, iterated on the interface, and prepared the public Cloudflare deployment.

GPT-5.6 runs the product workflow through the OpenAI Responses API. Its explicit roles are source triage with stated rationale, structured claim extraction, sourced-versus-modeled classification, BLUF drafting, and a final estimative-language pass. The public demo replays audited captures so judges need no API key, but it keeps the underlying GPT-5.6 response and request identifiers visible in the product instead of merely claiming that a model ran.

I supplied the intelligence tradecraft, source judgment, product direction, governance boundaries, and final editorial decisions. A separate AI assistant was used only as an independent citation and judge-path reviewer after the core build; it did not build the application's core functionality.

The stack is TypeScript, React, Next.js, vinext/Vite, Tailwind CSS, the OpenAI Responses API, and Cloudflare Workers. The repository is MIT licensed and includes one-command local setup, deterministic sample data, live-capture scripts, tests, a dated build log, and a clear disclosure of the relationship to my prior work.

Challenges we ran into

The hardest problem was making honesty demonstrable instead of decorative. A SOURCED badge is meaningless unless the claim actually opens to evidence. A MODELED badge is incomplete unless the product explains the inference. A "powered by GPT-5.6" label is weak unless the run itself has receipts.

That forced us to design the data model, interface, prompts, capture artifacts, and tests around traceability. It also meant resisting features that would look impressive but imply capabilities we had not earned. For example, organization workspaces and anonymized shared signals remain unbuilt until identity, authorization, retention, and privacy controls are designed.

Accomplishments that we're proud of

• A judge can run the complete golden path without an API key.
• Every important claim is inspectable at the point of use.
• Discarded evidence is visible, not silently hidden.
• All 16 scenario/profile variants carry verified GPT-5.6 provenance.
• Audience recuts change priority and recommended action without changing the underlying evidence.
• Governance references are free, linked to their official sources, and framed as self-assessment rather than certification.

What we learned

A brief you can check is worth more than a brief that merely sounds right. The same rule applies to the AI workflow: if a product asks users to trust that a model ran, it should be able to prove the run happened.

We also learned that calibrated uncertainty can be a product feature. Showing the base rate, the competing indicators, and the line between confidence and probability makes the brief more useful, not less decisive.

What's next for ThreatWatch Studio

The next step is paid pilot use with a small number of risk, insurance, travel, and logistics teams so we can learn which evidence and decisions matter in real operating rhythms. Product work would then focus on customer-configurable curated source packs, evaluation against analyst-reviewed briefs, and organization-scoped workspaces with role-based access, retention controls, and a privacy review.

We deliberately will not add open-ended source discovery or multi-user signals until the validation, identity, and governance controls are ready.

Built With

• 5.6
• cloudflare
• codex
• next.js
• nist
• openai
• react
• tailwind
• typescript
• vinext
• vite