Tessera

The deterministic-first design with sampled AI calls, EWMA-adaptive thresholds, a coverage gate and a rule that an error is never reported as SAFE goes well beyond a prompt wrapper. Commercial AI-informed WAFs already exist, which keeps a strong idea above average rather than exceptional, and Member A's 8 is generous against that prior art.

AI fills the exact gap the product claims, and removing the model calls leaves only a generic signature proxy. The runtime evidence is thin though, since no logs or artifacts show the model path executing and the demo simulates it, which supports the median between A's 8 and C's 5; missing committed API keys are not themselves evidence, as keys are never committed.

The target user and use case are concrete, and control is well designed with separate approval and activation, editable policy and budget ceilings. Real deployment spans Redis, Ed25519 keys, a GitHub App and Auth0, and the path visible to the jury is a simulation.

The landing page and docs are polished, with a real component library and professional tooling visible in the code. The only screenshots actually described are static pixel-art hero images rather than real UI captures, so the rendered dashboard is unverifiable, which caps the score below B's 7.5.

Roughly 58,700 LOC, 116 test cases and a working-looking Fastify ingress path with normalizer, runner and orchestrator exceed typical hackathon scope. Against that, the event-dated plan admits the proxy-dashboard wiring was still a plan on local mocks, the backend has no automated tests by its own docs, and the demo is scripted.