Anonymous feedback analytics without storing student identities.
SignalRoom is a feedback platform for higher education designed around anonymous response collection, database-enforced access control, concurrent single-use codes, aggregate analytics, and structured AI analysis.
The Higher Education Feedback Dilemma
Course feedback systems face two competing goals: instructors need actionable, structured feedback, while students need certainty that responses cannot be tied back to their grades or identities.
- Conventional authenticated surveys record student user IDs or emails alongside answers
- Unauthenticated surveys risk duplicate submissions, ballot stuffing, and unauthorized access
- How to authorize single submissions without storing who submitted what
- How to prevent race conditions when two students submit with the same response code simultaneously
Can feedback be submitted and verified without creating a student identity record at all?
System Overview & Capabilities
SignalRoom provides an administrative and instructor platform coupled with a zero-identity public submission portal.
- Admin: Manages departments, courses, instructor assignments, and accounts
- Instructor: Creates sessions, configures questions, generates response codes, uploads course materials, inspects analytics, and runs AI analysis
- Student / Respondent: Opens public session, enters single-use code, submits feedback—zero account or identity created
Data Flow & Infrastructure
Admin / Instructor (Supabase Auth) Student Respondent (No Account)
↓ ↓
Session Setup Enters Single-Use Code
↓ ↓
Generates Plaintext Codes (Shown Once) submit_anonymous_feedback RPC
↓ ↓
Stores SHA-256(code) in PostgreSQL SELECT ... FOR UPDATE (Lock Session & Code)
↓
Validate & Mark Used & Insert Response
↓
Aggregate Statistics (Recharts)
↓
Bounded Context AI (DeepSeek V4 Pro)
↓
Zod 5-Insight Schema ValidationConcurrency-Safe Anonymous Submission & Bounded Full-Context AI
Using database locks for code consumption and bounded context instead of unnecessary RAG
SignalRoom enforces single-use codes via a database transaction with SELECT ... FOR UPDATE locking both the session and the code record. If two concurrent requests arrive with the same code, the first consumes and marks the code as used; the second sees code already used and is rejected.
For AI analysis, SignalRoom is intentionally NOT RAG. A typical feedback session contains ~50 responses, instructor reflections, and a bounded syllabus PDF (max 30 pages / 60,000 chars). Passing the full bounded context directly to DeepSeek V4 Pro eliminates vector databases, chunking errors, and indexing latency while providing the model with complete holistic context.
The application does not collect or persist student identity data with feedback responses, and uses atomic database transactions rather than application mutexes to enforce single-use code correctness.
Engineering Details
Zero-Identity Data Model & SHA-256 Code Hashing
The responses table contains only response UUID, session ID, and submission timestamp.
- Zero identity columns: No student ID, email, user foreign key, raw IP, or browser fingerprint.
- Single-use codes generated from an unambiguous 30-character alphabet (23456789ABCDEFGHJKLMNPQRSTUVWXYZ).
- Plaintext code is displayed to the instructor once; the database only stores SHA-256(code).
Atomic Concurrency Lock (SELECT ... FOR UPDATE)
The submit_anonymous_feedback stored procedure executes atomic locking to eliminate race conditions.
Request A → locks code row
Request B → waits for lock
A → validates code & inserts response
A → marks code used & commits
B → acquires lock → sees code used → rejected!Why No RAG? (Bounded Context Decision)
SignalRoom deliberately avoids vector embeddings and RAG pipelines for feedback sessions.
- Dataset fits entirely within modern LLM context windows (~50 responses + bounded syllabus text).
- Eliminates vector DB dependencies, chunking edge-cases, and retrieval ranking errors.
- Model evaluates cross-response sentiment and theme correlations across 100% of responses simultaneously.
Zod-Enforced 5-Insight Structured Output
AI responses must conform to a strict schema of exactly five ranked insights with priority, finding, and evidence fields.
- Zod validates exactly 5 insights, ranks 1–5 without duplicates, and valid priority enums.
- Analysis results stored with immutable versioning metadata (prompt version, model, response count).
Abuse Mitigation & Rate Limiting
HMAC-SHA256 IP rate limiting (15 req / 10 min) hashes incoming IPs with a server secret to prevent raw IP logging, coupled with Cloudflare Turnstile bot protection.
System Centerpiece & Inspection
Inspect the live execution state, benchmarks, security boundaries, and architectural guarantees.
Database-Enforced Atomic Code Consumption
When two students attempt to submit simultaneously with the same 8-character single-use code token, PostgreSQL row locking guarantees exactly one submission succeeds.
1. Begins transaction: SELECT * FROM response_codes FOR UPDATE
2. Validates code 7X9K2MQ4 is unused
3. Inserts anonymous feedback row
4. Marks code status = 'used'
5. Transaction COMMITS atomically
1. Arrives during Request A transaction
2. Pauses at FOR UPDATE until lock released
3. Acquires lock after Request A commits
4. Inspects row: code is already 'used'!
5. Transaction ROLLS BACK and aborts
Rigorous Verification Evidence
4 unit suites, 1 concurrency suite, 3 Playwright E2E suites
Simultaneous race conditions produce exactly 1 submission
Rejects malformed, duplicate, or <5 insight responses
Unambiguous 30-char alphabet collision verified
Concurrent Single-Use Submission & AI Synthesis
Instructor launches mid-term feedback session with 40 single-use code tokens.
Instructor generates and distributes printed response code tokens
Two students attempt to submit feedback simultaneously with identical code
PostgreSQL SELECT FOR UPDATE locks the code record; Request A completes, Request B is rejected
Session reaches response threshold; instructor uploads course syllabus PDF
Bounded context engine feeds aggregate distributions, text responses, and syllabus to DeepSeek V4 Pro
Zod validates exactly 5 actionable, ranked insights with direct quotes and recommendations
Immutable analysis version saved for comparative semester tracking
Verified anonymity, zero code reuse, and deterministic structured AI insights.
Engineering Capabilities Proven
Disciplined Technical Claims
- SignalRoom removes application-level respondent identity, but cannot guarantee real-world anonymity against information users voluntarily reveal in free-text responses.
- A response code does not prove physical user identity; codes can be shared or transferred before submission.
- Physical code distribution could be tracked externally by an instructor outside the application.
- The bounded-context architecture is tailored for class-sized cohorts (~50 responses) and would require architectural redesign for massive enterprise-wide surveys.
Engineering Retrospective
Privacy is an architectural discipline, not a checkbox. The best way to protect respondent identity is never storing or collecting it in the first place.
Avoid Unnecessary RAG
When context fits comfortably within model limits, full-context ingestion gives better holistic reasoning without vector pipeline complexity.
Database Locks Over App Locks
Enforcing single-use code consumption inside a database transaction guarantees correctness across distributed server instances.