ScopeGuard AI — Scope Creep Protection for Freelancers Powered by Google Gemma & Render

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 2: Side Hustle

What I Built

Scope creep is the single biggest revenue and sanity leak for freelancers, independent contractors, and digital agencies. A client sends a message asking for "just one quick addition before launch," and without checking the contract, freelancers absorb hours of unpaid work out of fear of awkward confrontation.
ScopeGuard AI is an intelligent contract scope integrity engine designed specifically for independent workers. It compares incoming client messages against an agreed Statement of Work (SOW) and produces an objective, contract-grounded breakdown in seconds:

1. Task Decomposition: Breaks compound client emails into distinct, individual requests.
2. 3-Way Scope Classification:
   • 🟢 ALREADY_INCLUDED: Explicitly or reasonably covered by contract deliverables.
   • 🔴 LIKELY_ADDITIONAL: Clearly out of scope or explicitly excluded.
   • 🟡 NEEDS_CLARIFICATION: Ambiguous, unmentioned, or requiring further client discussion.
3. Independent Citation Verification: Every quoted contract clause is independently verified against the raw agreement text using an algorithmic verification engine to eliminate AI hallucinations.
4. Editable Change-Order Draft: Automatically drafts a polite, non-confrontational change-order reply with placeholders for hourly rates and timelines so freelancers can protect their billable hours without damaging client relationships.

Who would pay for this?

Freelance developers, design agencies, copywriters, and consultants who lose thousands of dollars every year to unbilled scope creep and awkward negotiations.

Demo

• Live Web Application: https://scopeguard-ui.onrender.com
• Backend Health Check: https://scopeguard-api.onrender.com/api/health

Code

The complete source code is open-source under the MIT license:

YashwantBisht45 / Hacktoberfest_Week_2_Challenege

ScopeGuard AI

"Know when a client request goes beyond the original deal."

ScopeGuard AI is an open-source, competition-focused application designed for the Hacktoberfest 2026 Open-Source AI Challenge (Submission Deadline: October 18, 2026).

It helps freelancers and digital agencies determine whether a new client request is already covered by their original project agreement, constitutes out-of-scope additional work, or requires contractual clarification — backed by independent quotation verification against the agreement text.

---

Current Status: Phase 6.1 (Pre-Deployment Audit & Verified Hosted Providers)

The application is prepared for public cloud demonstration on Render using hosted open-weight Gemma models while preserving full on-device local development with Ollama:

• Frontend: Responsive React 19, Vite, TypeScript, and Tailwind CSS. Deploys as a Render Static Site with dynamic backend base URL configuration (VITE_API_BASE_URL).
• Backend: Express with TypeScript, Zod validation, configurable rate limiting (RATE_LIMIT_MAX), reverse proxy trust (trust proxy), and safe…

View on GitHub

How I Built It

ScopeGuard AI is architected as a clean, decoupled monorepo:

1. Open-Weight AI Architecture

• Local Inference (Zero-Egress): Powered by Google Gemma 2 (gemma2:2b) running locally on device via Ollama. This guarantees 100% data privacy—no contract text or client messages ever leave the freelancer's machine.
• Hosted Fallback: Configured with an OpenAI-compatible adapter supporting hosted Google Gemma open-weight endpoints (e.g. OpenRouter / DeepInfra) for public cloud demos.
• Repetition & Loop Controls: Tuned with repeat_penalty: 1.15, repeat_last_n: 64, deterministic temperature: 0.1, and a single controlled retry to prevent token loops on compact open-weight models. ### 2. Algorithmic Evidence Verifier (Hallucination Defense) Large language models occasionally fabricate plausible-sounding clauses. ScopeGuard AI solves this by running an independent verification layer in TypeScript:
• Any quote the AI claims to be from the contract is extracted and matched against the raw SOW text using normalized spacing, punctuation normalization, and substring indexing.
• Quotes that do not exist verbatim in the contract are flagged as UNVERIFIED_OR_NOT_FOUND, preventing false claims in client negotiations. ### 3. Full-Stack Tech Stack
• Frontend: React 19, Vite, TypeScript, Tailwind CSS, Lucide icons.
• Backend: Node.js, Express, TypeScript, Zod schema validation, express-rate-limit.
• Test Suite: 40 passing Vitest unit tests covering CORS policies, Zod sanitization, model fallbacks, and citation verifiers.
• Live Evaluation Suite: Includes a dedicated script (npm run test:eval) testing 5 real scenarios: excluded ERP sync, included page updates, ambiguous popups, multi-item requests, and prompt injection resistance.

Why Does Open Innovation Matter?

In legal and contractual domains, privacy is non-negotiable. Freelancers frequently sign Non-Disclosure Agreements (NDAs) that strictly prohibit sending client specifications, unreleased product features, or pricing terms to third-party commercial APIs where data might be retained or used for training.
Open innovation and open-weight models like Google Gemma 2 make true zero-egress AI possible:

1. Total Data Sovereignty: Contract text stays on localhost (127.0.0.1).
2. Offline Reliability: Freelancers can analyze client requests on flights, trains, or off-grid without an active internet connection.
3. Auditability & Zero Vendor Lock-in: The prompts, token penalties, and inference pipelines are completely transparent and reproducible without depending on black-box proprietary APIs.

My Agent Session

This project was built pair-programming with Antigravity, Google DeepMind's advanced agentic coding assistant. The agent assisted across multiple lifecycle phases:

• Diagnosing Windows dual-stack IPv4/IPv6 connection refusals.
• Tuning Ollama generation options and implementing controlled error retries.
• Writing the algorithmic citation verifier and Vitest test suite.
• Preparing the Render monorepo deployment with automated render.yaml blueprint specs.

Prize Categories

1. 🏆 Best Use of Render ($200)

• How it qualifies: The entire ScopeGuard AI production architecture is deployed on Render:
  • Frontend: Hosted on Render as a high-performance Static Site (scopeguard-ui.onrender.com) with automated SPA rewrite rules and cache management.
  • Backend: Hosted on Render as a Node.js/Express Web Service (scopeguard-api.onrender.com) with custom reverse proxy trust, strict CORS origin controls, rate-limiting, and dual-stack binding.
  • Blueprint Automation: Ships with an automated render.yaml specification declaring both services, health check paths (/api/health), and environment variable bindings for reproducible one-click deploys.

2. 🏆 Best Use of Gemma ($200)

• How it qualifies: Google's open-weight Gemma model is the core intelligence engine powering ScopeGuard AI:
  • Zero-Egress Local Inference: Uses Gemma 2 (gemma2:2b) running locally on device via Ollama to guarantee 100% privacy for sensitive client contracts and NDAs without sending data to external clouds.
  • Hosted Gemma Fallback: Includes a dedicated cloud adapter to serve Google Gemma open-weight models (google/gemma-3-4b-it and gemma2) over OpenAI-compatible endpoints on our live Render deployment.
  • Gemma-Tuned Prompt & Generation Parameters: Specifically tuned for Gemma's architecture with repeat_penalty: 1.15, repeat_last_n: 64, deterministic temperature: 0.1, and a structured JSON pipeline.
  • Rigorous Evaluation Suite: Backed by an automated test suite (npm run test:eval) verifying Gemma across 5 real contract scenarios: excluded ERP sync, deliverable validation, ambiguous popups, multi-task decomposition, and prompt injection resistance.