Waylatch

Offline-ready emergency procurement and accountable payments. From field need to verified action.

Comment

Inspiration

A field team can lose connectivity while a coordinator still needs to understand what was requested, what evidence exists and who can authorize the purchase. Waylatch keeps those steps connected: preserve the need offline, carry it by QR, compare the records, retain human payment authority and inspect the resulting history.

Built by Colby Weiss / LeftSock Labs. This is a fictional emergency-procurement prototype, not a field-tested emergency system. No lending, autonomous spending or real-money transaction is demonstrated.

What it does

Offline need → QR handoff → Local AI evidence → Human decision → Verified Sandbox payment → Proof Trail.

A request survives browser refresh in IndexedDB, even while disconnected. Bounded QR packets reconstruct it in another browser profile. Interrupted, repeated and conflicting packets keep explicit states; receiving a request gives it no payment authority. Reconnection alone neither submits a request nor spends money.

After explicit submission, a coordinator compares records side by side. Local MiniLM retrieves related wording and displays semantic cosine alongside recorded receipt/reference, amount, incident, location and time context. Contradictions and missing facts stay visible. Ranked/grouped summaries preserve access to informational candidates; revision-aware unrelated dismissals reduce repeated presentation without erasing evidence. Related/unrelated/investigate notes remain advisory. Matching facts, even in the explicitly unvalidated strong tier, are not proof of the same purchase.

Authenticated server gates keep human REVIEW and AUTHORIZE separate from buyer approval and CAPTURE. Official PayPal Sandbox Orders v2, durable reservations, idempotency keys and reconciliation connect an approved request revision and exact amount to a completed capture. Claims have a separate review path; reimbursement transfer is unimplemented.

The Proof Trail distinguishes browser observations, server audit events and saved provider inspection. It shows missing events rather than inventing them. A sanitized report supports reading/sharing; a separate original organization-chain export preserves the actual SHA-256 preimages for independent validation. Administrators can rewrite a complete chain; it is neither immutable nor blockchain-backed.

Genuine historical PayPal evidence

Request RL-REAL-20261013-201748 revision 1, order 2W330508JA572391V, capture 8WY07860808872629: USD 1.00 simulated Sandbox funds, COMPLETED / PAID, $0 real spending. Actual human REVIEW/AUTHORIZE, genuine buyer approval and separate human CAPTURE preceded settlement. Saved independent provider inspection confirms the exact references and amount; the original seven-event chain validates.

The judge walkthrough and video show this as a separate read-only historical archive. They do not reenact checkout or imply that buyer approval was screen-recorded. New fictional requests inherit no historical payment claim. The original buyer's loopback return failed; authoritative inspection established approval. No additional purchase is required to judge Waylatch. Original evidence, independent inspection.

AI: useful comparison context, unproven detection

The unchanged Apache-2.0 Xenova/all-MiniLM-L6-v2 model executes genuine q8 CPU inference on the local Node server through Transformers.js/ONNX. Descriptions do not go to a paid inference service; the browser/phone does not execute embeddings. High cosine describes wording, not transaction identity or fraud probability. Structured recorded facts govern advisory attention tiers.

Both completed scientific evaluations remain unchanged and unfavorable. The original combined review flagged 70 of 72 labeled distinct held-out pairs. On a genuinely new frozen test with two blinded nonexpert AI judgments per case, revised attention reduced FP77→30, but precision worsened .384→.250, recall .889→.185, F1 .536→.213 and fixed-budget duplicate retrieval 6→4. Predefined targets failed. Zero strong alerts gives undefined strong precision. These are synthetic scenarios, not expert-human or field truth; no improved detection, ranking, human time savings or operational reliability is claimed. Missing supplier/line-allocation/fulfillment facts cannot be recovered from text. Full scientific evidence and both receipts.

How we built it

React, TypeScript and Vite preserve the existing Request → Review → Pay → Audit → Proof Trail interface. IndexedDB and a service worker provide local continuity. Zod and bounded MessagePack/CRC32 packets treat imports as untrusted. Node 24, Express and SQLite preserve requests, review decisions, financial reservations and audit history. Official PayPal Sandbox Orders v2 is central to the accountable-payment workflow. MiniLM supplies local language retrieval; it never grants financial authority.

Waylatch retains RescueLedger ancestry and legacy storage/QR compatibility. CrisisCodec is the same owner's unfinished project; limited owner-controlled packet/reconstruction reuse is disclosed in source provenance. New work during the October 2026 submission period includes procurement/claims, coordinator authorization, SQLite payment reservations, official PayPal Sandbox integration, independent chain validation, local semantic review, explainable comparisons and the guided judge experience. Third-party notices remain applicable. Owner-controlled application source is MIT licensed; dependency/model licenses remain independent.

Try Waylatch Live

Interactive demo: https://waylatch-judge.onrender.com

Experience the actual Waylatch application directly in your browser. Create fictional procurement requests, preserve them offline, reconstruct QR handoffs, use real server-side MiniLM semantic review, record human advisory decisions and explore the Proof Trail.

No installation, account or payment credentials are required. All payment operations are disabled in the public demonstration.

The demo runs on free hosting and may take approximately one minute to wake after inactivity. Sessions are temporary.

Technical reviewers can inspect the GitHub repository or optionally run the application locally using JUDGE_QUICKSTART.md.

Verification, challenges and what we learned

Final engineering checks: 164 unit/integration tests, all 14 original/competitive browser tests with real local AI, plus the same five competitive checks in a genuinely missing-model fallback. A separate real-model UI probe verifies the unvalidated-tier qualification at desktop/mobile widths. Targeted axe checks have zero violations; they do not certify universal accessibility. Clean setup, financial-route blocking, shutdown isolation, original audit-chain validation and dependency audit pass. Full-history credential/buyer-field triage and source/frontend scans found no confirmed leak within their documented scope.

The central lesson is that semantically similar wording does not establish transaction identity. Fewer warning panels did not establish better detection: the revised metrics worsened, and the failed evaluations remain preserved. Offline reconstruction, human authority and provider settlement require distinct evidence and explicit states.

Existing resilience measurements remain unchanged; tmpfs timings are not physical-disk benchmarks. Genuine signed webhook delivery and Payouts transfer remain unverified outside the successful Sandbox purchasing claim. This prototype has not been evaluated by field coordinators or assistive-technology users.

Demo and source

The approved 87.76-second silent captioned MP4 shows actual offline/QR operation, real local semantic retrieval/grouped comparison, human boundaries and separately labeled historical Sandbox proof. SHA-256: 96d6025a229905376f38b42ed75640caf1c85123b5dee7d27fece64de5557b6d. Buyer approval/capture were not screen-recorded or reenacted. Exact script/provenance.

Public MIT source, architecture, model instructions, engineering evidence. Real spending: $0.

Built With

Share this project:

Updates

Submission history