Can We Trust the Result?
TrustOS provides explainable AI integrity verification for interviews, coding assessments, online examinations, and remote work.
TrustOS is an AI Integrity Platform that helps organizations verify whether a candidate genuinely completed an interview, assessment, coding challenge, certification, or remote work session.
Instead of relying on plagiarism detectors or simple AI classifiers, TrustOS combines multiple behavioral signals into an Explainable Trust Score backed by real evidence.
Hackathon-TrustOS/
├── Chrome_Extension/ Chrome MV3 monitoring agent
│ ├── src/
│ │ ├── background/ Service worker + state management
│ │ ├── content/ Content script for page signals
│ │ ├── offscreen/ Media recording (audio + screen)
│ │ ├── popup/ React popup UI (framer-motion)
│ │ ├── detectors/ Tab, AI, behaviour, screenshot monitors
│ │ ├── services/ API client, WebSocket, session helpers
│ │ └── storage/ Event queue, Chrome storage wrapper
│ ├── public/icons/ Extension icons
│ ├── package.json
│ └── README.md
│
├── Windows_App/ Python desktop tracking application
│ └── README.md
│
├── Presentation/ Project presentation
│ └── TrustOS_Presentation.pdf
│
├── .gitignore
├── README.md
└── run-all.bat
The candidate-side monitoring agent that captures authorized session signals.
| Feature | How |
|---|---|
| Screenshots | chrome.tabs.captureVisibleTab (every 20s) |
| Screen recording | MediaRecorder in offscreen document (30s chunks) |
| Microphone | getUserMedia + MediaRecorder in offscreen document |
| Speech transcripts | Web Speech API via voice popup window |
| Tab/URL tracking | chrome.tabs listeners + content script |
| AI tool detection | URL matching against known AI domains |
| Clipboard | Paste/copy listeners (character counts only, no content) |
| Idle detection | chrome.idle API |
| Event queue | Chrome storage.local FIFO (cap 2000) + batch flush |
Key details:
- Speech recognition runs in a small popup window (not offscreen doc — Chromium limitation)
- Events flushed to backend every 60 seconds via
POST /api/events - Per-session config fetched from
GET /api/extension/session-config/{id}
See Chrome_Extension/README.md for full architecture.
FastAPI async backend with SQLite (default) or PostgreSQL.
| Endpoint | Purpose |
|---|---|
POST /api/auth/login |
JWT authentication |
POST /api/session/create |
Create monitoring session |
POST /api/events |
Batch event ingestion |
POST /api/evidence/upload |
Upload screenshots, audio, video, transcripts |
POST /api/analyze/session/{id} |
Run AI trust analysis |
GET /api/report/{id}/pdf |
Download PDF trust report |
GET /ws/session/{id} |
WebSocket live event feed |
GET /health |
Health check |
AI Engine: Mistral API for behaviour analysis, plagiarism detection (5-gram overlap), and report generation. Runs in offline mock mode when no API key is set.
Scoring model:
- Browser events (30%): tab switches, URL patterns, clipboard
- AI usage (30%): frequency, duration, tool type
- Behaviour (20%): keystroke patterns, idle time, typing speed
- Document (20%): reference document comparison
Python-based behavioural analysis engine that tracks face and hand movement using computer vision.
| Feature | Purpose |
|---|---|
| Head pose estimation | Detects yaw/pitch/roll — looking away from screen |
| Gaze direction | Tracks where candidate is looking |
| Hand-gesture detection | Phone usage, whispering, notes checking |
| Face presence | Detects face absent, multiple faces |
| Hand near face | Potential phone or note usage |
| Movement intensity | Overall body movement level |
| Camera access | Real-time webcam via OpenCV + MediaPipe |
| System tray | Runs silently with start/stop control |
Note: Screenshots, tab tracking, and clipboard monitoring are handled by the Chrome Extension, not the Windows App.
See Windows_App/README.md for full details.
| Layer | Technology |
|---|---|
| Chrome Extension | Manifest V3, TypeScript, React 18, Tailwind CSS, framer-motion |
| Build | Vite 6 |
| Backend | FastAPI (async), SQLAlchemy, Alembic |
| AI | Mistral API (large-latest, embed) |
| Database | SQLite (default), PostgreSQL |
| Auth | JWT (HS256), bcrypt |
| Desktop | Python 3.11+, OpenCV, MediaPipe, pystray |
| PDF Reports | ReportLab |
| Communication | REST + WebSockets |
cd Chrome_Extension/backend
python -m venv .venv
.\.venv\Scripts\activate
pip install -r requirements-dev.txt
Copy-Item .env.example .env
alembic upgrade head
python -m uvicorn app.main:app --reload --port 8000cd Chrome_Extension/dashboard
npm install
npm run dev
# http://localhost:5174cd Chrome_Extension/extension
npm install
npm run build
# Load dist/ in chrome://extensionsChrome_Extension\run-all.batLogin: proctor@trustos.dev / proctor123
The complete project presentation is available in the Presentation/ folder.
View TrustOS Presentation (PDF)
Click the link above — GitHub renders a built-in PDF viewer when you open the file.
The presentation covers:
- Problem Statement
- Product Vision
- System Architecture
- Workflow
- Technical Stack
- Demo Walkthrough
- Future Roadmap
- JWT authentication with token refresh
- Privacy-first design — clipboard contents never captured, keystroke counts only
- Evidence encrypted before upload
- Rate limiting on all endpoints
- Audit logging for all state changes
- CORS restricted to known origins
.envfiles excluded from version control- bcrypt password hashing
- MIME type validation on evidence upload
- Session-scoped data isolation
Read more:
- Security Policy — vulnerability reporting, hardening checklist, known limitations
- Contributing Guidelines — development setup, code style, PR process
- Code of Conduct — community standards
- License — MIT License
TrustOS aims to become the integrity layer between Humans, AI, and Digital Evaluations.
The goal is not to prohibit AI, but to provide transparent evidence explaining how AI was used and whether the outcome can be trusted.
Phase 1 — Chrome Extension, Backend APIs, Event Collection, Session Tracking
Phase 2 — AI Behaviour Engine, Explainable Trust Score, Report Generation
Phase 3 — Enterprise Dashboard, Multi-Organization Support, Analytics, API Integrations
Built by:
| Name | GitHub |
|---|---|
| Aarav Goel | @coderaarav12 |
| Priyanshu Mishra | @pm5120-alt |
| Parth Vats | @parthvats-code |
| Argha Atta | @TrueIncident |
This project is licensed under the MIT License.