case · shipped
Waypoint
Waypoint reprices disrupted corporate trips, asks a Qwen-powered adviser to choose book, hold, or escalate, then rechecks every recommendation with deterministic code before any booking can proceed. The shipped demo includes recorded Atlas replay, per-rail provenance, a durable ledger, and a zero-credential Docker deployment. Live ticketing remains fail-closed behind a human switch and provider availability.
- runtime gates
- 2
- searches max / cycle
- 20
- provenance rails
- 4
The problem
When a work trip is disrupted, the cheapest replacement fare is not always the safest choice. It can blow the team budget, expire before everyone confirms, or leave one traveler stranded. Waypoint treats rebooking as a treasury problem: every option has to fit the trip mandate, the available budget, and the needs of the full roster.
How it works
A manager opens a desk and sets the budget and booking limits. Travelers join through a shared link and verify themselves, then Waypoint reprices the affected itineraries against Atlas. A Qwen-powered adviser recommends book, hold, or escalate, with a written rationale for each position.
The model makes recommendations, not financial decisions. A deterministic execution wall recalculates authority, contingency, and budget before a booking can proceed. Every cycle is streamed over SSE and written to a SQLite ledger, so the desk can replay what happened and close its books cleanly.
Safety and provenance
Live booking requires two independent gates: a human-enabled switch and confirmed ticketing availability from the provider. If either gate is closed, Waypoint stays in comparison mode and does not issue write commands. Searches are capped at 20 per cycle, write operations are never retried, and a fare only counts as booked after the provider reports it as ticketed.
The Docker demo runs without provider credentials by replaying recorded Atlas responses. Its interface labels four provenance rails separately: Atlas data, the Qwen adviser, curated priors, and the code-computed ledger. Recorded behavior never presents itself as live.
What shipped
The project includes the Next.js desk interface, FastAPI orchestration service, Telegram roster flow, Atlas adapter, durable ledger, recorded replay mode, prompt-injection containment tests, and a zero-credential Docker deployment. The live Atlas ticketing path remains intentionally fail-closed because the end-to-end ticket assertion was not proven reliably during the build.