FieldDay: the allergy-smart grass window

memeshe — Tue, 06 Oct 2026 11:24:19 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 1: Touch Grass

What I Built

FieldDay tells allergy families the single best hour to go outside today — then gets out of the way. Parents of sneezy kids currently check three apps (weather, AQI, pollen) and guess; guess wrong and the evening is miserable. FieldDay fuses forecast + pollen + YOUR symptom history into one 0–100 score per daylight hour, explains the pick in warm parent-language, and fits in one mobile screen. Sixty seconds, then screen off — that's the whole point of Touch Grass.

The whole point: more days like this. (Rick Obst, CC BY 2.0, via Wikimedia Commons)

Beautiful — and exactly what triggers the sneezes. (Peter Salanki, CC BY 2.0, via Wikimedia Commons)

Demo

Live: https://fieldday-r66v.onrender.com (free Render tier, PWA — installable, works from the home screen)

Tested live Oct 6, Hanoi, straight from the production API: best window 08:00 local (score 76/100, personal flare risk 0.227 via TabPFN on 48 rows), worst 35/100 later in the week. Every hour is labeled with the model that scored it. Outdoor verification with photos lands this week — updating this post.

Code

https://github.com/memeshee/fieldday

FastAPI + vanilla JS, one-click deploy via render.yaml, 6 smoke tests with CI.

How I Built It

Open-source AI is the core, not a garnish:

TabPFN (Prior Labs tabular foundation model) predicts personal flare risk fitted on YOUR symptom log — not a generic county pollen number. Your browser gets a random anonymous ID, so your taps train your forecast and nobody else's. Lightweight tabpfn-client so Render's free tier never OOMs; self-hosters can swap in local tabpfn with zero code changes.
Gemma (open weights) writes the coach note. Chain: local Ollama gemma3:1b → hosted Gemma via Gemini API → labeled template fallback. The UI always names which source wrote the note — no silent fallbacks.
Free keyless data: Open-Meteo forecast + pollen, geocoding included.

Hardest part: latency. v1 called TabPFN once per daylight hour — 7s × 24, guaranteed timeout. Fixed by fitting once and batch-predicting all hours in one call, then caching the predictor keyed on the training-data fingerprint: 37s cold → 1.3s warm in prod. Second hardest: Open-Meteo 429-throttles Render's shared IP, which once blanked the whole demo — now retry + 30-min upstream cache + an honestly-labeled MET Norway backup feed. Third: labeling every AI output with its provenance (risk_source, coach source), including when it's "just" the baseline.

Why Does Open Innovation Matter?

Symptom logs are health-adjacent — they must never train someone else's closed model or require an account. Open weights + a tabular foundation model give a personal forecast with no account, no tracking, no per-call price tag: TabPFN inference sees anonymized rows and never trains on them, Gemma runs local-first. $0 to run, any model swappable. Closed APIs would make this a privacy compromise and a billing meter; open makes it a tool parents can trust.

My Agent Session

Built pair-programming with an AI agent (Hermes) — roughly 280 tool iterations across one session: real TabPFN verification, predictor cache, per-user logs, hosted-Gemma chain, PWA shell, upstream-resilience fallback, this post. No DevRelay link (session ran outside DevRelay); the full build log lives in the repo's commit history.

Prize Categories

Best Use of TabPFN
Best Use of Gemma
Best Use of Render
Overall

My Mum Keeps Getting Scam Texts. I Built Her a Telegram Shield.

memeshe — Sun, 04 Oct 2026 19:26:19 +0000

My Mum Keeps Getting Scam Texts. I Built Her a Telegram Shield.

This is a submission for the Hacktoberfest Weekend Challenge: Build for a Friend.

Live: t.me/scamsshield_bot · Dashboard · Repo

The friend

My mum gets parcel-scam SMSes in Thai almost weekly — "พัสดุถูกระงับ, ยืนยันตัวตนด่วน" with a bit.ly link, fake bank warnings, the works. She forwards them to me, I tell her "don't click that," and the cycle repeats. She's not going to learn to read headers. So I built the thing that reads them for her: ScamShield. She forwards any suspicious message to a Telegram bot, and in seconds gets back a verdict card — SCAM / SUSPICIOUS / LIKELY SAFE — with reasons in Thai first, English second, and what to do next.

What it actually does

Send anything — an SMS forward, a link, a wallet address — and the bot runs a triage pipeline:

Signal extraction — links, crypto addresses, phone numbers, urgency phrases ("ด่วน", "airdrop", "verify now"), impersonation hits (banks, Binance, Shopee, "ตำรวจ"…).
Live web grounding (SerpApi) — the suspicious domain gets searched for scam/fraud reports, so the verdict cites the web, not vibes.
On-chain probe — wallet addresses are checked against public RPCs: contract code (drainer pattern) vs plain wallet vs fresh/empty.
Score — transparent point rules, capped at 100. ≥70 SCAM, ≥40 SUSPICIOUS, else LIKELY SAFE.
Explanation by an open-weight model (Gemma) — two short sentences, Thai then English, written for a non-technical reader. The model explains; the rules decide. If the model is unreachable, the verdict still lands, honestly labelled rule-based.

Real outputs from the pipeline (cards exactly as the bot sends them):

🚨 Thai parcel scam → SCAM 75

🚨 อันตราย: น่าจะเป็นมิจฉาชีพ (SCAM, 75/100)

เหตุผล / Why:
• pressure tactics: ด่วน, ระงับ, ยืนยันตัวตน
• impersonates: พัสดุ
• suspicious link (shortener / risky domain)

ลิงก์ / Links:
`http://bit.ly/kerry-th-99`

เว็บพูดถึง / Web:
• bit.ly url scan | Free Url Scanner &amp; Phishing Detection — checkphish.bolster.ai/…

🤖 ข้อความนี้ดูน่าสงสัยเพราะใช้คำเร่งรีบและลิงก์ที่ดูไม่น่าเชื่อถือ อย่ากดลิงก์หรือกรอกข้อมูลส่วนตัวเด็ดขาด
This message is suspicious because it uses urgent language and an untrustworthy link. Do not click the link or enter any personal information.
_(model: gemma-4-26b-a4b-it)_

ทำอย่างไร / What to do:
• อย่าโอน อย่าให้ OTP — Do not send money or OTP
• ส่งมาให้ลูกดูก่อนเสมอ

✅ Family check-in → LIKELY SAFE 0

✅ ดูปลอดภัย (แต่ยังระวังไว้) (LIKELY SAFE, 0/100)

เหตุผล / Why:
• no pressure tactics, links, or crypto addresses found

🤖 ข้อความนี้ดูปลอดภัยเพราะเป็นแค่การถามไถ่ทั่วไปและไม่มีลิงก์แปลกๆ ให้กดครับ
This message looks safe because it is just a casual question and has no suspicious links.
_(model: gemma-4-26b-a4b-it)_

ทำอย่างไร / What to do:
• ไม่มีสัญญาณอันตราย แต่ถ้าไม่แน่ใจถามลูกก่อน
• ส่งมาให้ลูกดูก่อนเสมอ

There's also a live dashboard (latest verdicts stream in every 2 seconds, zero API credits burned on page views) and a /health endpoint the host watches.

Why open innovation is what makes this work

The prompt asks where open beats closed for this build. Three places, all load-bearing:

1. The explainer is an open-weight model behind a swappable plug. The verdict text my mum reads is written by Gemma through a plain OpenAI-compatible endpoint. This weekend that endpoint was, in turn: a big hosted Gemma (too slow, 35s+), a smaller one (fast, but it thinks out loud — it wraps everything in <thought> planning blocks), and finally the smaller one plus a 15-line answer-extractor that recovers the Thai/English sentences from inside the thinking. I could do that iteration in an evening because the model, the weights lineage, and the wire format are all inspectable and interchangeable. A closed black-box API gives you one behavior, take it or leave it. Next weekend the same code can point at Ollama on a laptop and nothing else changes — try that migration with a proprietary agent stack.

2. The score is readable by her kid. Every point comes from a named rule in one file (triage.py), and the card lists each reason. When the bot says 75, I can point at exactly which three signals added up. That transparency is the whole product for a family: trust isn't a brand, it's showing your work. Closed-scoring "AI fraud APIs" return a number and a shrug.

3. It costs $0 to run and nobody's data is the product. Free-tier hosting, 250 free SerpApi searches a month (only suspicious domains trigger one), public RPCs, an open model. A tool that protects your family shouldn't need a subscription or a data pipeline into someone's ad machine to survive.

What open didn't do: the score itself is still hand-written rules, and I'm saying so instead of dressing it up. The model explains; the rules decide; the receipts are real links and real RPC responses. A demo that fakes intelligence is worse than no demo.

How it's built

python-telegram-bot (polling worker inside the FastAPI lifespan) + FastAPI + httpx, on Render's free tier from a render.yaml. Telegram handlers have timeouts, an error handler, and a 120s triage budget so one slow provider can't wedge the bot. Every verdict is saved to SQLite and streamed to the dashboard. Sentry watches errors and performance. Nothing exotic — the exotic part is that it exists in my mum's chat app instead of a slide deck.

Built with: Render (hosting) · Gemma (open-weight explanations) · SerpApi (live search grounding) · Sentry (error + performance monitoring).

Repo: memeshee/scamshield — MIT, contributions welcome, especially Thai scam-pattern rules.

Handover

The bot is live in my mum's Telegram now. Her verdict on the verdicts lands here as an update — the real judging criterion was always whether she trusts it.

Disclosure: this write-up was drafted with an AI assistant; every verdict, link, and number in it was run and verified by the author against the live code.

DEV Community: memeshe

FieldDay: the allergy-smart grass window

What I Built

Demo

Code

How I Built It

Why Does Open Innovation Matter?

My Agent Session

Prize Categories

My Mum Keeps Getting Scam Texts. I Built Her a Telegram Shield.

My Mum Keeps Getting Scam Texts. I Built Her a Telegram Shield.

The friend

What it actually does

Why open innovation is what makes this work

How it's built

Handover