Veritas

The investigation platform where the AI never gets the final word.

H0: Hack the Zero Stack with Vercel v0 and AWS Databases - Track 2 (Monetizable B2B) AWS database: Amazon Aurora PostgreSQL (Serverless v2) - Front end: Next.js on Vercel

Veritas turns an autonomous AI security investigation into a court-defensible, queryable record. An agent investigates digital evidence end to end, but deterministic code, not the model, decides what is "confirmed," and every finding traces by foreign key to the exact tool record that proved it. When the model over-calls a threat, Veritas overrules it and shows the gate that withheld promotion.

Live, public, no login: https://veritas-rouge.vercel.app

Demo (2:22) - real footage of the live app

A screen capture of the live app working end to end: the case dashboard, the AI overruled by deterministic code (the model said CONFIRMED, the gate held it at SUSPICIOUS), a confirmed finding expanded to the raw forensic-tool output that proved it, the cross-case IOC pivot returning all three cases for one PID, and the self-draining runs queue - then the Amazon Aurora schema and the live cluster in the AWS console. Source: docs/veritas-demo-live.mp4.

---

Architecture

End-to-end pipeline

Project structure

---

Why Amazon Aurora PostgreSQL

The domain is a naturally normalized, join-heavy chain of custody, and the data model is the product:

• Foreign keys enforce chain-of-custody integrity - a finding cannot reference proof that does not exist.
• UNIQUE(case_id, fact_signature) turns the engine's in-memory SHA1 dedup into an idempotent ON CONFLICT UPSERT - cross-tool corroboration merges in one statement.
• The engine's ~19 pivot indexes become real Postgres indexes (btree, GIN on JSONB, pg_trgm for fuzzy IOC search), so cross-case hunting is one indexed query the file-based engine cannot do.
• A recursive CTE walks the process tree; a finding_trace() function returns the full proof chain.
• Row-level security by org_id is scaffolded in the schema (it flips the app to multi-tenant SaaS the moment auth is turned on; the public demo runs open by design); a materialized view powers the cross-case pivot; Serverless v2 scales down between investigations.

DynamoDB was considered and rejected (19 pivot indexes would need 5+ GSIs, conditional-write merges, and an N+1 join storm). Aurora DSQL was rejected for the build window (no pg_trgm). See db/schema.sql and db/demo_queries.sql.

The data is real

Every case is an actual investigation of a Windows intrusion, ingested from the open-source Sentinel Ensemble engine. No numbers are invented: the ingest adapter asserts the database disposition counts match the engine output exactly.

Run it locally (no AWS needed to build)

# 1. Postgres (local stand-in for Aurora)
sudo docker run -d --name veritas-pg -e POSTGRES_PASSWORD=veritas \
  -e POSTGRES_DB=veritas -p 5433:5432 postgres:16

# 2. schema + ingest a captured run
sudo docker exec -i veritas-pg psql -U postgres -d veritas < db/schema.sql
python -m venv .venv && . .venv/bin/activate && pip install ijson "psycopg[binary]"
DATABASE_URL=postgresql://postgres:veritas@localhost:5433/veritas \
  python ingest/ingest.py <capture_dir> --case-name "rd01 (opus)"

# 3. the web app
cd web && npm install && DATABASE_URL=postgresql://postgres:veritas@localhost:5433/veritas npm run dev

Going to Aurora is a connection-string swap (DATABASE_URL + PGSSL=require).

Submission

• Live app: https://veritas-rouge.vercel.app
• Demo video: watch on YouTube - 2:22, real screen capture of the live app functioning, footage-first, answering the three judge questions (problem, for whom, and why). Source: docs/veritas-demo-live.mp4.
• Submission text: docs/SUBMISSION.md
• Architecture / pipeline / structure: docs/

MIT License. Built on Sentinel Ensemble.