RIPPLE

Councils have the budget to fix broken infrastructure, and citizens can see what is broken. The bridge between the two is a council web form that takes about fifteen minutes and wants a full name, address and phone number — so most problems are simply never reported, and without volume data councils have nothing to prioritise against.

Rebuild that bridge as a progressive web app with no accounts in it. You open a map of what has been reported nearby, photograph the problem, and submit; a random UUID in localStorage is the only identifier the system holds. Classification runs on the phone under LiteRT.js — WebGPU where available, WASM where not — so the photo is transmitted only after Submit and only as evidence, never as something a server has to interpret. Reports made with no signal queue in IndexedDB and flush on reconnect, and council attribution is a point-in-polygon test against cached boundaries, decided on the device before anything is sent. The front end of all of that is live; the data layer behind it is not deployed.

You see the same pothole every day on your commute. Reporting it means a council web form that takes about fifteen minutes and wants your full name, address and phone number — so you don't, and neither does anyone else, and the council never learns the road is a priority. Ripple is that bridge rebuilt: open the map, photograph the problem, submit. A random UUID in localStorage is the only identifier the system holds.

The part that makes it defensible is that classification happens on the phone. An int8 .tflite model runs under LiteRT.js — WebGPU where available, WASM and XNNPACK where not — and returns a category and a confidence before anything is uploaded. The photo is transmitted only after Submit, and only as evidence, never as something a server has to interpret. Warm inference measures 15 ms at p50 against a 3,000 ms budget, but the latency is the second reason; the first is that a civic app that loses the trust argument does not get installed.

The interface treats the model as fallible on purpose. Above 85% confidence the result snaps in. Between 60 and 84% it asks "does this look right?". Below 60% it offers two options and emphasises neither. If the model is missing or the runtime fails, it drops to a manual picker, and every override is recorded as {ai_category, ai_confidence, final_category} — which is what will make accuracy measurable later, rather than asserted now. It has to be, because the model that ships is a generic ImageNet backbone: the runtime, the cache path and the latency are real, and the civic fine-tune is not built.

The real story of this project is the audit. In March the repository said twenty sprints were complete, on the criterion that TypeScript and ESLint passed — for a codebase with zero tests. In August I measured it against its own checkmarks instead, and found seven false subtask claims, no test files at all against a written "no test, no merge" rule, and a Supabase project that returned NXDOMAIN. Every "applied to production" line described a database that no longer existed. Everything on this page after that point exists because something that had been marked done turned out not to be.

React 19, TypeScript and Vite, built as an offline-first PWA and served as one bundle: no React Native version, no Swift version, no Capacitor wrapper. Mapbox GL renders the map with clustering and a keyboard-navigable parallel list, because a canvas has no accessibility tree. State is Zustand; the offline queue is IndexedDB via idb, mounted at the app root so it flushes from anywhere rather than only from the report screen.

Inference is @litertjs/core with the WASM runtime served from our own origin rather than a CDN, and the model fetched from a versioned URL so swapping in a fine-tune is a one-line change. Preprocessing is the Canvas API — centre crop, never squash — which is what lets TensorFlow.js stay out of the dependency tree entirely rather than being swapped for something else.

The data layer is PostgreSQL with row-level security as the security boundary, Deno edge functions for submission and status changes with Zod validation and server-side rate limiting, a generated tsvector column with a GIN index for search, and logical replication for live updates. Twenty-seven migrations apply cleanly to a throwaway PostgreSQL 17.11 and are then attacked as the anon role — that harness is the only reason the data layer can be spoken about at all, because the hosted project it was written against was deleted.

Council attribution runs client-side: Turf point-in-polygon against cached boundary polygons, with overlapping areas resolved by nearest centroid rather than by unspecified row order, because attribution that depends on which row the database returns first is a bug waiting for a busy day.

In March the repository reported twenty sprints complete. The completion criterion offered was "TypeScript and ESLint pass with zero errors" — which, for a codebase with no test files at all, measures compilation rather than correctness. An August audit re-measured the repo against its own checkmarks instead of trusting them: seven subtask claims were individually false, there was not one test file against a written "no test, no merge" rule, and the Supabase project the entire backend was written against returned NXDOMAIN from two independent public resolvers. Because Supabase keeps paused projects resolving, that meant deleted, not paused — so every "applied to production" line in the plan described a database that no longer existed.

The more useful output was not the bug list but a question to ask of any green check: what would this have to look like to fail? Four of this project's own gates had no answer. The typecheck gate ran `tsc --noEmit` against the root tsconfig, a solution file with `"files": []`, so it checked zero files and exited 0. The PWA check used the regex `/navigateFallback|offline\.html/`, which accepts either answer and could therefore never detect the wrong one. The RLS tests declared the attacker's token as a literal fixture, proving the attack failed without ever testing whether the credential could be obtained. And a column-level `REVOKE` reports success whether or not it changed anything. All four were green, and not one of them could have failed.

The security repairs were worse than the bookkeeping. Two RLS policies named `_own` were written `USING (true)`, so any anonymous caller could delete anyone's upvote and every stored notification email was world-readable. Fixing those was recorded as proven by attack. It was not: running the whole chain rather than its second half found `reports.reporter_token` still world-readable, because RLS is row-level and filters no columns. Harvest a token off the public map, replay it as the `x-reporter-token` header, read a stranger's notification email, delete their upvote — four steps, all four succeeded, against a migration comment that asserted in writing that tokens were not handed out. The fix is the sharpest detail in the repo: `REVOKE SELECT (reporter_token) ON reports FROM anon` is a silent no-op while a table-level `GRANT SELECT` exists, because table and column privileges live in separate ACLs and the table-level check short-circuits the per-column one. Migration 025 drops the table grant and re-grants only the columns that stay public.

Then the ones a user would have hit. GPS failure was an unrecoverable dead end: at the timeout the hook cleared its loading flag with latitude still null, so the location line rendered as blank space and Submit stayed permanently disabled — no error, no way forward. All eight of the Edge Function's validation messages were unreachable, because supabase-js does not parse non-2xx bodies, so someone over the note limit was told "Edge Function returned a non-2xx status code". The service worker served the offline page to online users — `navigateFallback` pointed at offline.html and a workbox `NavigationRoute` matches every navigation — which broke every deep link, the exact surface shared reports exist to provide, and hid because in-app link clicks issue no navigation request. The offline queue only flushed while the user happened to be sitting on /report. Rate limiting was localStorage theatre, defeated by one devtools click. And three colour tokens sat below the WCAG AA contrast floor in an app whose stated purpose includes reporting accessibility hazards, where the first attempt at a fix changed nothing visible, because the palette is defined in three places and only one was edited.

Every figure was produced by running its command against the frozen tree, not carried forward from a document. Inference was benchmarked with the real LiteRT WASM runtime against a real int8 .tflite in a real browser: 15 ms p50, 22 ms p95, against a 3,000 ms budget — and recorded as a lower bound on Apple Silicon with WebGPU, explicitly not a mid-range-Android figure.

The database layer was proved by execution rather than review. A throwaway local PostgreSQL 17.11 applies all 27 migrations and is then attacked as the `anon` role: 102 assertions, 0 failures. It earned its keep on the first run by catching migration 017 calling `calculate_priority(NEW.id)` from a BEFORE UPDATE trigger, where the table still holds the old row — so the function re-read the status it was in the middle of replacing and the status penalty never applied. That is the exact bug the migration exists to fix, reintroduced one line below the comment describing it, and it would have been invisible in production in the direction that keeps resolved reports ranked urgent on a council dashboard. Realtime was read straight off a pgoutput replication slot, the same protocol Supabase consumes.

Offline was verified by cutting the network: the model resolves from Cache Storage byte-identical at 5,434,517 bytes and every route still renders. Lighthouse was run on both presets, which is how the 92 previously on record turned out to be a desktop number quoted without its form factor — on the mobile preset a 375px-first PWA is actually judged by, Performance is 68.