Probandolenguas

Probandolenguas is an app-agnostic language-learning relationship. Learners can text or send voice notes in the chat apps they already use; the shared learning engine replies there and generates a short private exercise link only when a screen is useful. The same approved goal can still recompile into desktop writing, no-screen audio, low-energy exposure or printable work.

The public contest corpus contains only public-domain, CC0 and project-owned CC0 material. Copyrighted references explored during research were removed before the contest build and do not contribute to the submitted optimizer, product or metrics.

The current submitted corpus is stricter than that policy permits: all 5,500 rows are project-authored CC0. The earlier 1872–1923 literary slice was removed because rights-safe historical language was still a poor fit for modern conversation.

What is implemented

• A 5,500-intent Spanish corpus behind a mandatory source manifest and fail-closed Public-Domain | CC0-1.0 license gate.
• Five renderers over one approved introduction: phone, desktop, no-screen, low-energy and print/handwriting.
• A channel-neutral learning-turn contract for Telegram, WhatsApp, Instagram and web delivery. Channel adapters normalize transport; the coordinator never depends on a messaging vendor.
• A concrete Telegram webhook for text and real voice notes, including bounded Telegram file download, Spanish transcription, meaning-first coaching, generated voice reply, AI-voice disclosure, duplicate-update rejection and webhook-secret verification.
• A learner-bound English judge demo that exposes its assumed 500-word universe, lets the judge choose three of fifteen computed 501-600 candidates, teaches them through ten mechanically verified contexts per word while a two-voice podcast renders privately. The podcast is delivered only after all three word walkthroughs finish. A learner can interrupt any phase with an English-learning question and then return to the exact lesson position before moving through listening, recognition, writing, speech and open conversation. Every candidate example, definition, dialogue turn and coach reply is mechanically restricted to the known 500 plus the chosen three.
• Durable Telegram learner state through PostgreSQL: HMAC-indexed and AES-256-GCM-encrypted channel bindings, retry-bounded inbound/outbound idempotency, shared learner/global model budgets and content-free audit events.
• A real two-minute, no-screen audio review generated only from phrases the learner has already produced: guidance is explicitly English, every Spanish target chunk is owned, and Ogg/Opus granules must prove a 105–135 second result before delivery. It uses a bounded 1/3/7/14/30-day re-exposure ladder; listening records exposure, never mastery.
• Explicit reminder consent, quiet hours, weekly caps, adaptive backoff and listen/later/pause controls. /misdatos exports the canonical learner model; /borrar uses a second confirmation before cascading deletion.
• Opaque, encrypted, expiring personalized exercise links with server-side grading. Expected answers are not exposed in the URL, and completion does not silently manufacture mastery evidence.
• A credential-free deterministic Learning Coordinator that selects IDs from an approved atom enum and compiles the lesson across all five contexts.
• An optional GPT-5.6 Responses API coordinator. Server code checks its selection against the same approved enum before compiling any lesson.
• An optional handwriting route with image-instruction defenses, strict structured output, expiring signed evidence proposals, same-process replay rejection and explicit learner confirmation. Confirmation changes no server-side state.
• Per-atom, per-skill evidence in the current browser tab. Confirmed writing can raise writing/recall; a photo cannot raise speaking or listening.
• A bounded anonymous learner snapshot feeds evidence back into the next coordinator request as untrusted client self-report; unknown atoms, mismatched skills and malformed evidence are discarded.
• Passive exposure counters that never change mastery evidence.
• Shared persistent model budgets, request timeouts, metadata-stripped image uploads, learning-purpose guardrails, stateless Responses calls and an honest keyless fallback.
• A nested E(L) curriculum: a human-curated 50-atom foundation that the math audits but cannot replace, followed by group-balanced packs of 10.
• A preregistered, procedurally blinded 360-task semantic protocol for N=50 through N=100; model calls and human scoring remain explicitly unrun.

With DATABASE_URL configured, Telegram learner state is durable. The browser demonstration remains deliberately anonymous and its evidence survives only in the current tab; the UI states that limitation.

Rights-safe corpus

Slice	Rows	License
Project-authored modern conversation	3,000	CC0-1.0
Project-authored fun-to-say	1,000	CC0-1.0
Project-authored modern Chile / LatAm	1,000	CC0-1.0
Project-authored circumlocution / utility	500	CC0-1.0
Total	5,500	CC0-1.0

The Chile/LatAm slice contains ten practical construction families and 300 Chile-specific rows. Every row stores its locked source hash, construction family, region, stable ID and leakage-control group. Mechanical gates pass; the strict contest-release gate still requires Kavi to sign off the deterministic 100-row language sample. See corpus provenance, the review packet, and the source manifest. Disqualified research material remains outside the repository under the documented private quarantine boundary.

Reproduce the corpus and optimizer

Python 3.11+ is sufficient; the pipeline uses the standard library.

cd optimizer
python3 safe_corpus.py validate-manifest --check-urls
python3 safe_corpus.py build --check-urls
# Only after a corpus change: python3 prepare_latam_review.py --force
python3 optimize100_v2.py
python3 elcurve_v2.py
python3 semantic_eval.py validate
python3 -m unittest discover -s tests -v
python3 audit_corpus.py

The group-aware folds contain 4,396 train, 549 validation and 555 test rows, which collapse to 350, 47 and 48 conversational nuclei. Alternative phrasings of one project-authored CC0 nucleus receive one vote together, and whole lexical construction groups stay in one fold. This prevents both template leakage and row multiplication from manufacturing a better score.

At 100 atoms, 26.4% of held-out nuclei are within one missing atom and 67.3% are within two. Both the balanced curriculum and the legacy row-frequency baseline score 34.6% on the primary distance-weighted conversation-reach diagnostic; the balanced curriculum has slightly higher secondary atom coverage (73.6% versus 73.3%). That is a tie, not an optimizer victory. The fun-to-say lane retains its full 18.2% authored share, because this is a long-term conversational course rather than an emergency phrasebook. can_claim_optimizer_victory remains false until a preregistered, equal-attempt semantic evaluation earns a stronger claim. See the optimizer result.

The next claim is already locked before results: 30 deterministic held-out intents, six 50→100 checkpoints, two anonymous curricula and one attempt per arm. Its arms are the legacy row-frequency baseline and the balanced staged curriculum. The 360-task packet has made no model calls. See the semantic protocol.

Run the application

cd app
npm ci
cp .env.example .env.local  # optional
npm run dev

With OPENAI_API_KEY set, server routes call the gpt-5.6 alias through the Responses API. Telegram voice turns additionally use gpt-4o-transcribe for the completed voice-note file and gpt-4o-mini-tts for the reply. The official model page confirms that the text alias routes to GPT-5.6 Sol and supports Responses, structured outputs and image input: GPT-5.6 Sol documentation.

Without a key, session compilation and the browser chat demonstration use labeled deterministic fallbacks. Handwriting and voice transcription honestly report unavailable; neither displays a canned transcript as if it came from an upload. No key is sent to the browser. Exercise links require an independent EXERCISE_SIGNING_SECRET, even when model calls are disabled.

Live Telegram state and voice also require durable PostgreSQL, Telegram credentials and independent channel-binding and OpenAI safety-ID secrets. Production refuses to substitute an in-process learner store.

Deployment controls are documented in app/.env.example, including the three OpenAI model choices, shared budget limits, signing/HMAC/encryption secrets, PostgreSQL, internal scheduler secrets, public origin and Telegram credentials. Telegram posts to /api/channels/telegram; the browser adapter posts to /api/channels/demo. See the channel architecture and security and retention runbook.

The production package is a standalone, non-root Next.js container, a private PostgreSQL 16 service and an internal reminder/retention scheduler with its own freshness health check. docker-compose.yml publishes only the app through Caddy; PostgreSQL has no host port. kua.json maps the runtime to the probandolenguas/prod Kua-Vault namespace and https://probandolenguas.kua.cl. After deployment, activate Telegram without putting its token in shell arguments or logs:

kua-vault run --project probandolenguas --env prod -- \
  npm --prefix app run telegram:activate

The activation command installs the bot description and commands, registers a secret-token-protected webhook, and verifies Telegram's returned webhook state. The complete cutover, phone-acceptance and rollback procedure is in the live Telegram runbook.

The audio choices follow OpenAI's current request-response guidance for speech-to-text and text-to-speech. Keep the public browser deployment keyless. Anonymous browser routes retain a secondary per-process guard; authenticated channel calls use the PostgreSQL usage ledger so horizontal instances share learner and global limits.

Verification

python3 optimizer/verify_release.py

This rebuilds the corpus and optimizer, validates the procedural-blinding protocol, runs 22 Python tests, installs the exact Node lockfile, runs 23 portable core tests, then provisions disposable PostgreSQL 16 from the exact schema and runs all 24 core tests with zero skips, builds Next.js and exercises all 15 mode/time combinations plus the encrypted exercise flow against a production server. A second production smoke test sends six requests through the real OpenAI SDK to a loopback-only fake Responses server. It covers valid, adversarial and malformed coordinator/handwriting responses, confirmation and replay rejection while making zero billable API calls.

A third production test impersonates both Telegram and OpenAI locally. It runs a real SDK voice path—Telegram download → gpt-4o-transcribe → GPT-5.6 coaching → gpt-4o-mini-tts → one atomic Telegram voice message with its disclosed caption and encrypted exercise button—then requests and receives a second, duration-verified, known-Spanish-only two-minute audio review while making zero external or billable calls.

The stricter python3 optimizer/verify_release.py --contest-release additionally requires:

1. Kavi's 100-row Chile/LatAm language review marked approved.
2. Kavi's real introduction.mp4, extracted audio and verified transcript.
3. A signed, hash-locked CC0 media release.

The app does not disguise a placeholder as that recording; see the demo-media instructions and contributor release.

OpenAI and Codex

• GPT-5.6 was the coding and reasoning model used in Codex during the contest build. Codex built the rights gate, corpus builder, staged optimizer, application, tests, audit integration and contest materials.
• The public browser demonstration requires no OpenAI API key. It uses the deterministic approved-atom and conversational fallbacks. Live Telegram voice understanding requires private server-side OpenAI and Telegram credentials; neither is shipped to the browser.
• Primary Codex /feedback implementation session (the copyright-safe corpus, runnable contest application, release hardening and tests): 019f79cc-e4eb-7fb0-8e1c-bc9ee1f85991.
• Foundation and architecture session (the learning method, E(L) research, context-adaptive architecture and initial scaffold): 019f68f2-7772-73f0-9253-5500b9a3cf55.

Codex opened the implementation continuation as a separate technical session, although both sessions worked in this same repository. The primary ID above is the single /feedback ID for the submitted implementation; the second ID is included for transparent Build Week provenance. See Build Week provenance.

This matches the official Build Week rules: the project must be built with Codex and GPT-5.6, and the submission must explain how both contributed. The rules do not require the deployed app to call a model at runtime.

Software is MIT licensed. Project-authored linguistic content is dedicated under CC0 in CONTENT_LICENSE.md. Longer-term work is separated from contest-critical work in ROADMAP.md. The current manual and machine-verifiable release state is in the release evidence checklist.