SYNTHETIC DEMO — No real customer data or live proposal submission.
BidOS

AI bid intelligence & proposal OS

RFPs in. Decision-ready proposals out.

AI-assisted bid operations that connect requirements, evidence, drafting, review, QA and export in one workflow — and refuse to claim what it cannot cite.

View Architecture

Synthetic company Northstar Cloud Systems answering the synthetic Orion Enterprise Cloud Modernization Program: 83 requirements, 13 deliberate traps with no evidence, one hidden prompt-injection line. No real customer data.

Problem

Proposal teams lose weeks to re-finding what they already know

Requirements get missed, answers are copied from stale decks, reviewers cannot tell what is verified, and the same questionnaire is answered from scratch every quarter.

Stance

Honest by construction

Every factual sentence must cite approved evidence. Where nothing supports a claim the system says Needs evidence, generates the question for the right expert, and routes it — it never invents a certification.

Workflow

One pipeline, four human gates

  1. Intake & parsePDF, DOCX, XLSX, CSV, Markdown with cell-accurate locators.
  2. ExtractSpan-anchored requirements; injected instructions are ignored, not obeyed.
  3. Gate 1 · ConfirmHumans confirm the matrix.
  4. QualifyRadar scorecard as evidence for the bid / no-bid call (Gate 2).
  5. Draft & verifyHybrid retrieval → evidence gate → grounded draft → sentence-level claim verifier → label.
  6. SME loopGaps become routed tasks; statements become citable evidence; answers re-draft automatically.
  7. Gate 3 · ReviewReviewers approve; approved answers enter the library.
  8. Assemble, QA, Gate 4, Export16+ deterministic checks block export while blockers exist; DOCX, PDF, MD, JSON, CSV and questionnaire round-trip.

Product screens

Built for review, not chat

Requirement workspace

Split view: matrix on the left, source span, evidence rail, verified draft and review controls on the right.

Bid command center

Stage tracker, gate actions, run log, qualification radar and the primary next action.

Launch checklist QA

Ready score, blockers, warnings and info with deep links to the exact issue.

Evidence-backed AI

Labels come from facts, not confidence scores

Evidence gate

A chunk qualifies only if it covers the requirement's salient terms and mentions its hard terms (numbers, acronyms, proper nouns). The union of qualified chunks must cover every hard term, or the answer stops at Insufficient evidence.

Claim verifier

Every factual sentence needs a citation marker; every number and hard term must appear in the cited chunk; lexical overlap must clear a threshold. Unsupported sentences are highlighted, counted and blocked by QA.

Provider router

Local model → configured provider → deterministic demo floor. Sensitivity gate, cache, token budgets, schema validation with one repair, logged fallbacks. The demo needs no keys.

Prompt-injection resistance

Buyer documents are untrusted data. Instruction lines are filtered at extraction and the synthetic RFP contains one to prove it.

QA

Export is a gate, not a button

Missing mandatory answers, weak or absent evidence, missing citations, placeholders, stale or expired sources, contradictions, unsupported sentences, unresolved SME tasks, missing attachments and sections — each finding links to its entity and blocks export until resolved or dismissed with a reason.

ROI model

Estimated operational savings, formula visible and editable

hours = drafted × baseline hours × draft saving + reused × baseline hours × reuse saving + bids × admin hours × 50%. Every input is a setting on the Analytics page; every output is labelled an estimate.

Architecture

One Go binary, no external services required

Web UI (net/http, html/template, inline SVG)
app servicespipeline engineDB job runnereval harness
docs parsersextractionhybrid retrieval (BM25 + embeddings + RRF)AI router + verifiervertical packs
SQLite (pure Go) · local file store · optional OpenAI-compatible endpoints · optional Slack / ClickUp / inbox adapters

Security principles

Server-side authorization

Sessions, RBAC per action, organization scoping on every query, CSRF tokens, rate limits, upload validation.

Keys never reach the browser

Provider credentials live in the environment; every result is labelled with its provider mode.

Sensitivity gate

Internal or confidential data only goes to providers explicitly allowed for it; otherwise the local model or demo floor answers.

See it run on synthetic data

Sign in as a role

3-minute script: start the pipeline → extraction with source spans → a strong answer → a trap question → answer as the SME → upload the addendum → run QA → export the round-trip questionnaire → Quality page.