Built on trust. By design.

The thesis and the consent boundary

AuthWords asks whether a particular submission is consistent with a particular student's authenticated writing history, under the assignment's permitted-assistance policy. It is not an AI detector, a plagiarism detector, or a measure of moral intent. A low score means insufficient support for verification—not evidence of misconduct. The ordinary academic grade is never reduced by declining verification.

The data advantage is longitudinal and multimodal, not covert. Before any historical collection, the student sees the sources, time range, purpose, retention period, and recipients. Discussion posts, supervised timed writing, attributable group contributions, drafts, and peer feedback are separate consent scopes. Email is off by default: explicitly select authorized academic messages and remove other people's quoted content, signatures, and identifiers locally. Do not crawl an inbox or silently repurpose private communication.

Offer a no-cost supervised writing or oral-defense pathway so that privacy-conscious students, students with sparse digital histories, and students with disabilities can earn the same enhancement. A Verified A preserves the instructor's A and adds evidence of authorship; it is not a higher numeric grade or a promise of employment. Measure whether the opt-in scheme creates coercion or unequal opportunity before expanding it.

Two trust planes, one hard egress boundary

Deploy the evidence plane in a university-controlled Kubernetes cluster or an institution-owned private VPC with a contractually approved region. Source connectors, identity mapping, queues, feature extraction, inference, and the private student interface all remain inside that perimeter. AuthWords operators get no standing access. Each institution has separate databases, service accounts, encryption keys, and network policy; do not share a multi-tenant vector index.

The public plane serves static product assets, federation public keys, revocation artifacts, and explicitly shared credential proofs. The model-result egress allowlist is only a rounded P(authorship | evidence), its uncertainty/abstention state, and a small controlled vocabulary of interpretative flags. Never export embeddings, source excerpts, per-feature fingerprints, course IDs, LMS user IDs, or a stable student identifier. Scores are still sensitive and are private by default; a public share requires separate authorization.

UNIVERSITY TRUST BOUNDARY
Canvas / Blackboard / Moodle / authorized mail
    ↓ signed event or scoped reconciliation
Bun connector → PostgreSQL inbox + transactional outbox
    ↓ opaque artifact reference, never text
Redis 7 + BullMQ → Node 22 orchestration worker
    ↓ institution-local fetch, consent re-check
SECURE ANALYSIS BOX: local Python + ONNX → Bayesian ensemble
    ↓ encrypted derived state; raw buffers discarded
Private review UI → policy gate → institutional credential signer
══════════════ EXPLICIT EGRESS ALLOWLIST ══════════════
Minimal signed assertion → public verification + status list

Native integration with the existing frontend

Keep the current TanStack Start application: React 19, Vite, @tailwindcss/vite for Tailwind CSS v4, @tanstack/react-router, and @tanstack/react-query. Use createServerFn for typed, schema-validated internal commands and server routes for OIDC/LTI form POSTs and machine webhooks. Zod validates every boundary. Drizzle with node-postgres connects to local PostgreSQL; jose handles JOSE messages. Server secrets must never use a VITE_ prefix.

Build with bun --bun vite build and the documented nitro/vite plugin using the bun preset; run the emitted Bun server inside the institution. Pin the tested Bun, Start, React, Vite, and Nitro versions in bun.lock, build reproducibly with bun install --frozen-lockfile, and run Bun integration tests for session cookies, streaming, and LTI form posts. Nitro's integration evolves: upgrade behind a compatibility suite, not a floating latest deployment.

Bun serves the web/BFF and lightweight connectors. BullMQ runs on a separately pinned Node 22 worker rather than assuming complete Bun compatibility with all Redis/Lua worker behavior. Python 3.12 workers host spaCy, scikit-learn, LightGBM, PyMC, and ONNX Runtime. The language boundary is protobuf over a Unix socket or mutually authenticated in-cluster gRPC. No remote model API is called. These are internal services, not a rewrite of the frontend.

Reference-app boundary: this interactive workspace runs on the provided Next.js App Router / PostgreSQL sandbox. Its synthetic metrics, consent CRUD, and Ed25519 demo signatures are working features. The production target remains TanStack Start; LTI connections, the trained ensemble, confidential compute, and university identity are architectural specifications, not integrations secretly running in this demo.

Queue semantics, scale, and observability

Normalize events to tenant, deployment, source, opaque subject, artifact, version, event time, received time, provenance class, consent receipt, and assignment-policy version. Deduplicate on (tenant, source, artifact, version). Atomically commit the inbox receipt and outbox record before acknowledging a webhook. The outbox relay can publish twice; workers use the same unique job key and idempotent result upserts. Claim at-least-once delivery, not impossible end-to-end exactly-once execution.

Queue payloads contain only opaque institutional references. Fetch source text just in time after a second consent check. For sources with unavoidable text-bearing events, terminate inside the box, do not persist the body, and fetch authoritative content through the source API. If that is impossible, reject the integration until an institution-approved ephemeral path exists. Redis persistence and dead-letter queues never contain text.

• Initial topology: 3 Bun replicas, 2 outbox relays using FOR UPDATE SKIP LOCKED, 2 Node orchestrators, 4 CPU inference workers; PostgreSQL primary plus synchronous standby and an institution-local Redis HA deployment. GPU inference is optional, not required for launch.
• Partition concurrency by institution and source, cap per-student work, honor Retry-After, and use exponential backoff with jitter. After five retryable failures, send only an opaque reference plus error code to the dead-letter queue. Malformed or revoked-consent jobs are not retried.
• Illustrative sizing, not a benchmark: 100,000 artifacts/day is 1.16 jobs/s average. A 20× peak is about 23 jobs/s. At a measured two seconds per job, provision at least 66 concurrent slots for 70% utilization, or equivalent tested batching. The initial four workers are a pilot, not the peak-capacity claim.
• Set targets of webhook acknowledgement p95 <250 ms and completed verification p95 <60 s for an ordinary 2,000-word artifact at rated load. Establish actual capacity with k6 and a synthetic corpus before committing an SLA.
• Use OpenTelemetry + Prometheus/Grafana locally with content-free spans. Measure queue age, abstention, calibration error, source lag, purge failures, and subgroup error intervals. Alert on content-shaped payloads and denied egress. No third-party session replay or model telemetry.