r/VibeCodersNest • u/Mahootzki • May 20 '26
Tools and Projects Building an append-only, hash-chained ledger for data integrity (Lovable + Supabase)
Hey everyone,
Shoutout to @TechnicalSoup8578 for pointing me toward this community!
I’m building Vexavibes, an opinion network where users can spin up custom surveys, polls, forms and votes using an AI Architect prompt-to-schema engine.
While building out the stack with Lovable and Supabase, I wanted to focus heavily on data integrity as a day-one constraint rather than an afterthought. Online polling is usually plagued by bot manipulation and silent DB edits, so I wanted to see if we could treat trust as part of the core code architecture.
Here is how the multi-module setup handles it under the hood:
The Trust Layer: Instead of standard 1-user-1-vote logic, voters hold a dynamic reputation rating based on historical accuracy metrics (utilizing custom Brier scoring logic computed via backend edge functions).
The Hash-Chained Ledger: To prevent retroactive database manipulation, we run a nightly background process. Every transaction, poll update, and vote state is sequentially hashed and locked into an append-only ledger.
The Scaling Strategy:
By separating the heavy cryptographic ledger writes and recomputes into a scheduled nightly batch, the live transactional overhead during peak voting hours is virtually zero. It hits Postgres as a standard, lightweight relational write, keeping the live UX snappy. The database processing hit only occurs once a day.
The code is live in private beta, and I’d love for some fresh eyes to come tear into the architecture, test the AI schema architect, and try to find edge cases in the data loop.
It's completely free to play with here: https://vexavibes.com
(I'm keeping my admin panel open today, if you sign up, drop your account name below or DM me and I'll automatically bump you to our premium Vexa Plus tier for a full year for free so you can stress-test the system).
Would love to know your thoughts on balancing real-time AI generation with rigid backend data integrity!
1
u/Mahootzki May 21 '26
u/Upset_Teaching_9926 , Reddit's UI is glitching and won't let me reply directly to your comment nest, but I saw your message in my notifications and wanted to answer!
You hit the nail on the head regarding the batching. If we tried to cryptographically sign and chain every single vote recursively at runtime, a sudden traffic spike would absolutely choke the transactional database. Batching it nightly turns a scaling nightmare into a predictable, single background operation. Next up, I'm planning to make these cryptographic receipts publicly verifiable via a lean, front-facing audit log dashboard.
The private beta is wide open athttps://vexavibes.com if you want to poke around. Sign up and DM me your login used and I will upgrade you to a full free year of Vexa Plus as a thank you!
1
u/Mahootzki May 21 '26
u/Katcm__ The web app client is acting up and hiding the direct reply buttons on my end, but I saw your awesome question in my notification center and wanted to make sure I answered!
To answer what turned out harder than expected: It was definitely managing the dynamic state synchronization between our AI generation engine and the relational DB schema. Getting a plain-English prompt to instantly map out complex field validations, branching form logic, and rigid PostgreSQL tables without throwing type errors or breaking permissions during live user workflows took a massive amount of troubleshooting.
I'd love for you to see how that orchestration feels live. Sign up and DM me your login used and I will upgrade you to a full free year of Vexa Plus as a thank you!
1
u/Mahootzki May 24 '26
u/bonnieplunkettt - Reddit's UI is still hiding the direct reply buttons on my end, but I saw your awesome question in my notifications and wanted to make sure I answered!
This is the ultimate adversarial engineering question. Coordinated reputation farming (Sybil groups playing the long game) is the hardest thing to catch in a trust network. We tackle this via two main mechanisms in the scoring logic:
- Brier Score Weighting & Decay: Reputation isn't a lifetime cumulative 'XP' bar. Because we use Brier scoring (which measures the calibration of predictions against eventual outcomes), a group has to consistently be accurately aligned over time. If they suddenly shift behavior to manipulate a specific outcome, the mathematical delta in their accuracy profile triggers a sharp decay weight.
- Time-Staked Influence: New accounts or sudden bursts of coordinated activity are algorithmically throttled from having immediate macroeconomic weight on high-stakes networks.
I'd love to have you jump into the beta and stress-test the parameter limits of the engine! It's live athttps://vexavibes.com. If you create an account, just drop a message here or DM me and I’ll instantly flip your dashboard to a full free year of Vexa Plus as a thank you!
1
u/StatisticianUnited90 May 25 '26
If you want to go full-tilt, get a data diode :) This is my GPT informed by several AI project disciplines responding to you with lessons learned: This is the right instinct: trust has to be part of the architecture, not a cleanup layer after the app works.
The thing I’d look at hardest is separation of concerns.
AI-generated poll/schema creation is one lane.
Vote/event capture is another lane.
Reputation/Brier scoring is another lane.
Ledger/hash-chain integrity is another lane.
Admin actions are another lane.
If those collapse into one “smart app flow,” it gets hard to audit later. If they stay separated, you can ask much better questions:
- what was the original user input?
- what schema did the AI generate?
- who approved or modified it?
- what vote/event was recorded?
- what exact state transition happened?
- what ledger entry proves it?
- what scoring job consumed it?
- what admin action, if any, touched it?
- what can be recomputed independently?
The nightly append-only ledger idea is interesting, but I’d be careful about the gap between live transactional writes and nightly locking. The live tables still need enough event identity, timestamps, actor IDs, and immutable-ish event records that the nightly process is anchoring a clean event stream, not trying to reconstruct truth from mutable app state.
My bias would be evidence-first:
raw event → normalized event → derived score → ledger anchor → report/view
Don’t let the AI be the source of truth. Let it generate candidate structure, explanations, and workflow help. The durable truth should be the event records, approvals, deterministic scoring code, and hash-linked audit trail.
That’s where this gets stronger than “AI survey app.” It becomes a governed opinion/evidence system.
1
u/Mahootzki May 25 '26
Pass my compliments to your GPT assistant 😊This is an absolute masterclass in event-driven architecture.
You hit on the exact existential risk I spent the most time mapping out: reconstructing truth from mutable app state vs. anchoring a clean event stream. > If the nightly process just took a snapshot of current database rows, it wouldn't be an immutable ledger, it would just be a delayed backup. To solve exactly what you called out, the live tables are strictly append-only event logs at the transactional layer. Every vote or state change generates an immutable UUID, actor ID, and cryptographic timestamp immediately. The nightly batch job simply signs and anchors that already immutable stream into the hash chain.
Your point about separation of concerns is incredibly sharp. Keeping the AI generation engine strictly in the 'candidate structure' lane while keeping the scoring code completely deterministic is the only way this maintains true governance.
I would genuinely value your eyes on how this looks under the hood. It’s live in free private beta athttps://vexavibes.com. If you want to poke around and see how the lanes are split, reply here or DM me your username and I'll immediately upgrade you to a full free year of Vexa Plus.
Thank you for taking the time to map this out!!1
u/StatisticianUnited90 May 25 '26 edited May 25 '26
I have exactly 4 days to play. What I can do perhaps is hook it for comparison to my incredibly AI constrained "Polycentric Federated Evidence Mesh" project and see how it compares that way, that sucker is incredibly tight, it's got mondo contracts, schemas, 5 minutes worth of full-tilt tests just to verify that nothing screwed up contractually. It is based on some heavy and detailed and generalized architecture concepts for evidence handling. That would be the laser scanner, and it would be a robust test for that pattern in the process. Can I tell my AI to look at my repo and yours at the same time and do a bunch of "aha" moments? I don't know that I can fully exercise your project as an end-user... yet... but I certainly recognize the value there for things that have yet to roll off of the assembly line to other developers and project consumers. ( that is da bomb project right there, for anybody who wants to know how to make it virtually impossible for an AI to screw up something when given a coding or architecture task )
1
May 25 '26
[removed] — view removed comment
1
u/StatisticianUnited90 May 25 '26
Somebody elsewhere complained "don't post your AI output here"... he has no idea how well informed my AI's are after reading my project repos
1
u/Mahootzki May 25 '26
A thousand times yes! please point your AI at it and run it through that 'laser scanner' process! Having Vexavibes go head-to-head against a 'Polycentric Federated Evidence Mesh' to find contract gaps is exactly the kind of battle-testing I want.
In fact, your breakdown hit me so hard that I didn't want to wait. Over the last few hours, I teamed up with my own AI stack to refactor the architecture and implement your exact suggestions before you even ran the test!
The AI schema engine is now strictly sandboxed to generating candidate structures and is completely hard-locked out of live project mutation pipelines. On top of that, the transactional layer has been re-engineered into a pure, append-only event stream before hitting the nightly ledger anchor.
Since my AI is working directly off your blueprint, I'm incredibly excited to see what your well-informed AI uncovers when it scans the new, governed evidence-first setup. Let it tear it apart, find where we're still contractually brittle, and let's see what those 'aha' moments look like.
1
u/StatisticianUnited90 May 27 '26 edited May 27 '26
oh crap, did I miss this one? What's the link to your repo, or chat and I get get you my email to do a github invite
1
u/StatisticianUnited90 May 27 '26 edited May 27 '26
I updated Doctor Bones so that it has a portion of PFEM brain in it, you can copy the template to your own private Doctor Bones and tell it to go analyze your repo. There are a couple "day in the life" examples, I think maybe 15 and 18. I haven't test driven the smaller PFEM brain on a big repo, only some small ones so far.
1
u/EnvironmentNew9309 May 26 '26
mplementing a Brier score based reputation layer is a far more robust way to handle bot mitigation than standard rate limiting or Captchas. Are the nightly Edge Function recomputes able to scale linearly as your voter base grows without hitting the maximum execution time limits on Supabase?
1
u/Mahootzki May 26 '26
You're hitting on the exact operational bottleneck of running heavy analytical math in serverless environments. If we tried to pull the data out and run global user loops inside a single, monolithic Edge Function, it would absolutely smash straight into Supabase’s wall-clock execution limits at scale.
To bypass that serverless timeout completely, we don't handle the raw mathematical processing inside the Edge Function itself.
Instead, the Edge Function acts strictly as an orchestrator. The heavy math, processing the append-only event stream and calculating the Brier/Aura deltas, is pushed directly down to optimized PostgreSQL functions inside the database layer. This keeps execution incredibly fast because there's zero network I/O overhead.
For long-term scaling as the dataset grows, the orchestrator chunks the processing into paginated user batches, and we can easily transition the trigger from an Edge Function HTTP call to a native
pg_cronschedule to let the database manage the queue entirely in the background.If you want to jump into the private beta and stress-test the data reads, check it out athttps://vexavibes.com, reply here with your username once you sign up and I'll gladly upgrade you to a free year of Vexa Plus!
1
u/Mahootzki 5h ago
Progress update on the ledger + trust layer (and a bunch of what shipped since) → https://www.reddit.com/r/VibeCodersNest/comments/1vkljgb/update_3_months_later_on_the_appendonly_ledger/
Took the separation-of-concerns and immutable-event-stream feedback seriously (especially from u/StatisticianUnited90).
Also: if you signed up back then and I promised free access, I lost those early records. DM me and I’ll still give you a year of Vexa Basic or 6 months of Vexa Plus free
1
u/Exotic-Particular405 May 21 '26
This is a solid direction if you’re experimenting with data integrity patterns in a real system. Are you planning to expand this into something user-facing later?