Building Proof of Work for Developers: How I Used Hash Chaining to Make Skill Verification Tamper-Proof

The problem

Anyone can write "Expert in Python" on a resume. Recruiters know this,
which is why technical interviews exist — but they're slow, expensive,
and don't scale, especially in markets where trust signals (LinkedIn
endorsements, GitHub stars, alumni networks) are thinner than in the
US/EU tech hubs.

I'm building Hokay, a platform for French-speaking African developers,
around a different idea: instead of claiming skills, you prove them —
and that proof is cryptographically verifiable, not just a badge someone
could have faked or bought.

The core mechanic: hash chaining

Every time a developer solves a challenge on Hokay, their submission
gets recorded as a snapshot. Every few minutes, snapshots get chained
together using SHA-256 — each new hash includes the previous one, the
same principle blockchains use for tamper-evidence, minus the
distributed consensus overhead (I don't need a blockchain, I need
verifiability).

The result: if anyone — including me, as the platform owner — tried to
retroactively edit someone's history (inflate a score, backdate a
submission), the hash chain breaks and it's detectable. Every developer
gets a public certificate they can share, and anyone can verify it
wasn't tampered with.

The stack

• Django + Django REST Framework for the API
• Django Channels + Daphne for real-time features (chat, live challenge status)
• Celery + Redis for async processing (challenge evaluation, notifications, snapshotting)
• PostgreSQL as the source of truth
• Firebase Cloud Messaging for push notifications
• A custom code evaluator supporting 18+ languages, sandboxed with firejail, with AI-assisted scoring (Groq) for challenges that aren't pure input/output matching

What I learned building this solo

1. The hard part isn't the crypto, it's the plumbing. Hash chaining
   itself is maybe 100 lines of code. Making sure every notification
   path actually fires (push notifications on Android turned out to
   have three separate silent-failure modes — I wrote about debugging
   that separately) took a full evening of systematic debugging.

2. Trust infrastructure is worthless without users. I can build
   the most cryptographically sound verification system in the world —
   if nobody's solving challenges, there's nothing to verify. Retention
   is now my only real metric that matters.

3. Building for an underserved market means building the whole
   stack yourself. There's no local Stripe-equivalent trust
   infrastructure, no established dev-certification culture to plug
   into — you're building the primitives, not just the app.

What's next

Hokay is free and live at hokay.site. I'd love
feedback from other developers — especially anyone who's tackled
skill-verification or reputation systems before. What would make you
trust a platform's "proof" claim?