Commercial-construction bidding is a manual process — RFPs, plan sets, spec books, addendum trails, supplier quotes, cost history. Qubickeystone ingests all of it into a citation-grade context library and produces AI estimates, bid packages, branded HTML presentations, and project plans where every figure traces back to a page region in a source document (or an explicit user entry). Provenance is a first-class type: claim → extraction → page → document, versioned so citations never point at stale content. NestJS API, Next.js 15 dashboard, Python FastAPI sidecar for word-level bounding boxes, Postgres 16 with pgvector for hybrid FTS + vector retrieval fused via reciprocal-rank fusion in SQL. Single-tenant, single-Linode, no Docker.
// features
- Every figure is interrogable — select any number, get its full provenance chain (source document → page → region → extraction → derivation → estimate line)
- Hybrid retrieval that fuses Postgres tsvector + pg_trgm with pgvector HNSW via reciprocal-rank fusion, tuned for spec section numbers and part codes that embeddings blur
- Branded HTML presentations at a real URL — no PPTX pipeline, browser + shared link + print-to-PDF render identically
- Field-level envelope encryption on individual wage records with a k-anonymity floor of 3 on rate snapshots; estimating consumes blended snapshots, never raw wages
- Ingestion DAG in BullMQ 5: page render → text extraction → OCR fallback → classification → chunk/embed → entity extraction → cross-confirmation
- AI tiered by task through a single AiGateway: Haiku 4.5 for classification, Sonnet 4.6 for extraction + chat + vision, a top-tier model for estimate synthesis and the narrative report
- A prioritized self-directed research queue whose findings are proposed until a human accepts them — never silently merged into the estimate
// interesting details
- Provenance is a graph of typed relations in Postgres — claims cite extractions, extractions cite page regions, page regions cite documents; estimate lines cite claims; derivations cite operand claims. Retiring a document version retires both the chunk rows and their embeddings in one transaction, because citations must never point at stale content.
- Word-level bounding boxes come from PyMuPDF in a Python FastAPI sidecar bound to localhost — the Node process can't reach it externally. Scanned pages fall back to Tesseract 5's hOCR output (which preserves word coordinates) so the provenance model is uniform across native and OCR text. Drawing pages additionally get a Sonnet vision pass for titleblocks and legends.
- Master key sits at /etc/keystone/master.key (0400, root, injected via systemd LoadCredential=). Rotation is a single-transaction re-encrypt of every envelope-encrypted column. The retire step is gated: verify-decrypt → post-rotation backup → restore-drill → only then destroy the old key AND the pre-rotation pg_dumps that depend on it.
- Every AI call routes through one AiGateway service — model selection, prompt versioning, token accounting per project, retry/backoff, and a full request/response audit log. Provenance applies to the AI itself: when someone asks why the model said this, the answer is a row you can read.
// tech stack
Want to collaborate on qubickeystone?
The repo is private — drop a note and tell us what brought you here.