Claude Code Hackathon Winners

Architecture Review — Built with Opus 4.6, February 10–16, 2026

13K
Applied
500
Selected
$100K
API Credits
5
Winners

None of the top finishers were professional software engineers. A lawyer, a road inspector, a cardiologist, and a musician-engineer. They won because they understood their problems better than anyone else.

1st Place

CrossBeam

Mike Brown — Attorney, California

AI agent that processes ADU permit corrections. Two-phase human-in-the-loop, decision tree routing, 10-30 min agent runs.

Next.js 16Agent SDKCloud RunSupabase
2nd Place

Elisa

Jon McBee — Road Inspector

Spec-driven agentic dev environment for kids 8-14. Blocks → specs → DAG → parallel agents → real code → ESP32 hardware.

React 19BlocklyAgent SDKElectron
3rd Place

PostVisit.ai

Dr. Michal Nedoszytko — Cardiologist

Post-visit patient care platform. 8-layer context assembly, 15 AI services, tested in a real hospital.

Laravel 12Vue 3PostgreSQL15 AI Services
Creative Award

Conductr

Asep Bagja Priandana — Musician/Engineer

Real-time AI music collaboration. C/WASM for low-latency audio, WebMIDI input, multi-track generation.

C/WASMWebMIDIClaude API
Bonus Winner

everything-claude-code

Affaan Mustafa

Production-grade Claude Code config system. 14 agents, 56+ skills, 33 commands, AgentShield security framework.

14 Agents56+ Skills102 Security Rules50K+ Stars
Deep Domain Knowledge + Information Processing Tasks + Underserved Users
PatternSourceUse When
Decision tree router for skillsCrossBeamStructured reference knowledge (legal, medical, compliance)
Two-phase human-in-the-loopCrossBeamAgent needs human judgment mid-workflow
Long-running agent on serverlessCrossBeamAgent runs >5 min
Testing ladder with cost budgetsCrossBeamAgent SDK dev ($0.01 → $15 progression)
8-layer context assemblyPostVisit.aiMulti-source knowledge, 1M context window
Prompt caching (78% savings)PostVisit.aiMulti-turn with stable system prompts
Tool-use reasoning pipelinePostVisit.aiAgent queries external APIs mid-reasoning
Spec-driven developmentElisaVisual interfaces → AI code generation
Context chain between agentsElisaMulti-agent workflows needing coherence
Real-time WASM + AIConductrLatency-sensitive AI collaboration
Hooks over promptseverything-claude-code100% enforcement vs ~80% compliance
AgentShield security auditeverything-claude-codeSecuring AI agent configurations
01

CrossBeam

Problem

California ADU permits: 90%+ first-submission rejection rate. Most rejections are administrative (missing signatures, wrong citations), not engineering. 6-month average delay, ~$30K cost.

Next.js 16 (Vercel) → Supabase Realtime ↓ Cloud Run (Express 5) → returns 202 immediately ↓ Vercel Sandbox (Agent SDK + claude_code preset) ↓ Claude Opus 4.6 (vision + web search + tools) ↓ Supabase (PostgreSQL + Realtime + Object Storage)

Why this stack: Agent runs 10-30 min. Serverless timeouts at 60-300s. GCP kills idle at ~5 min. Cloud Run persists, Vercel Sandbox gives filesystem access, detached mode survives drops, Supabase Realtime bridges sandbox→frontend.

Pattern: Decision Tree Router

Instead of stuffing all 28 legal reference files into context, classify each query first, load only 3-5 relevant files. Four-step routing: Lot type → Construction type → Situational modifiers (transit, coastal, fire, HOA) → Process stage.

Quick-reference thresholds embedded for fast lookup: JADU max 500 sq ft, ADU max 1,200 sq ft, Height 16/18/25 ft by type, Fee exemption ≤750 sq ft.

Takeaway

Generalizable to any domain with structured reference knowledge. Don't dump everything—route to what's relevant.

Pattern: Two-Phase Human-in-the-Loop

Phase 1 (~15 min, ~$3): Agent reads corrections → researches codes → generates questions → PAUSE.

Human step: Contractor answers via frontend form.

Phase 2 (~8 min, ~$3): Agent reads answers → generates response letter + scope + report.

Phase 1 outputs persisted to outputs table. Questions parsed into contractor_answers table with types (text, number, choice, measurement). Phase 2 reads both.

Pattern: Long-Running Agent on Serverless

ProblemSolution
Serverless timeout (60-300s)Cloud Run persistent process, returns 202
GCP kills idle (~5 min)Detached sandbox mode (detached: true)
Connection dropsResilient polling (120 retries, 60 min max)
Frontend needs updatesSupabase Realtime, fire-and-forget logging

Pattern: Testing Ladder with Cost Budgets

LevelTimeCostWhat It Tests
L030s$0.01SDK config, skill discovery
L12m$0.50Single skill invocation
L23m$1.00Task tool + bash + images
L37m$5.00Multi-skill orchestration
L420m$15.00Full real-data acceptance

Haiku/Sonnet for L0-L2, Opus for L3+. Catch $0.01 bugs before $15 runs.

Pattern: Agent SDK Configuration

query({
  options: {
    tools: { type: 'preset', preset: 'claude_code' },
    settingSources: ['project'],
    permissionMode: 'bypassPermissions',
    allowDangerouslySkipPermissions: true,
    allowedTools: ['Skill','Task','Read','Write','Edit',
                   'Bash','Glob','Grep','WebSearch','WebFetch'],
    model: 'claude-opus-4-6',
    maxTurns: 80,
    maxBudgetUsd: 15.00,
  }
});

Gotchas: Skills not found → need settingSources: ['project']. Model init fails → use full alias 'claude-opus-4-6'. Wrong cwd → loads 13 skills instead of 6. Hangs on permissions → need both bypass flags.

Other Notable Patterns

Key Files

FileWhy
adu-skill-development/skill/california-adu/SKILL.mdDecision tree router pattern
agents-crossbeam/src/utils/config.tsProven Agent SDK config factory
server/src/services/sandbox.tsVercel Sandbox lifecycle (850 lines)
agents-crossbeam/src/flows/corrections-analysis.tsPhase 1 flow
test-assets/correction-01/Complete agent run outputs
02

Elisa

Problem

Block-based tools (Scratch) have a ceiling — you can only do what predefined blocks allow. Text-based coding is intimidating for kids. No bridge exists between visual play and real production code.

This is far more than a Scratch clone. Elisa is a spec-driven agentic development environment for ages 8-14. Kids arrange blocks → blocks become a structured spec → Claude agents decompose the spec into a task DAG → multiple agents execute tasks in parallel → real code is generated, tested, committed to git, and deployed — including to physical ESP32 hardware.

Blockly Editor (React 19 + Vite) ↓ NuggetSpec JSON Express Backend (WebSocket + REST) ↓ MetaPlanner (Claude Opus API → task DAG) ↓ AgentRunner × 3 concurrent (Claude Agent SDK) ↓ git commit per task TestRunner (pytest / Jest auto-detect) ↓ DeployPhase (web server / ESP32 flash / portals) ↓ WebSocket events Frontend (real-time streaming)

Pattern: Spec-Driven Development

The core paradigm flip. Code is a generated artifact, not the artifact itself. Kids specify what they want via blocks. The NuggetSpec is the intermediate representation — structured, validated, machine-readable. Agents translate spec → implementation.

interface NuggetSpec {
  nugget: { goal, description, type }
  requirements: [{ type, description }]
  style?: { visual, personality }
  agents: [{ name, role, persona }]
  deployment: { target, auto_flash }
  workflow: { review_enabled, testing_enabled, human_gates }
  skills?: [{ id, name, prompt, category }]
  devices?: [{ pluginId, instanceId, fields }]
}

Pattern: Parallel Agent Execution (DAG-Scheduled)

while (tasks_remaining) {
  const ready = getReadyTasks()  // no unfinished dependencies
  for (const task of ready) launchTask(task)
  await Promise.race([all_inflight_tasks])
}

Max 3 concurrent agents. DAG validated for cycles using Kahn's topological sort. Each task = one Agent SDK query() call: permissionMode: 'bypassPermissions', model: 'claude-opus-4-6', maxTurns: 25. Agent roles: Builder (writes code), Tester (writes/runs tests), Reviewer (code quality), Custom (user-defined).

Pattern: Context Chain Between Agents

Solves the "agent doesn't know what previous agent did" problem without token waste:

Agent 1 completes → summary written to nugget_context.md → Agent 2 reads context + structural digest (signatures only) → Agent 3 reads updated context.

No re-orientation. No dumping full source. Just summaries + structure.

Pattern: Device Plugin System

New hardware types added by dropping files — no code changes:

devices/{plugin-id}/
├── device.json           # Manifest: board, capabilities, Blockly blocks
├── prompts/
│   └── agent-context.md  # Injected into builder agent prompts
├── templates/            # MicroPython code generation templates
└── lib/                  # Shared libraries flashed alongside user code

Four built-in plugins (ESP32 variants). Deploy ordering respects provides/requires DAG.

Frontend: One Hook Rules All

No Redux, no Zustand. All state in useBuildSession.ts: useReducer with typed discriminated union actions. WebSocket events dispatched as actions. 30+ WebSocket event types. UI phases: design → building → review → deploy → done.

Other Notable Patterns

What Makes This Exceptional

03

PostVisit.ai

Problem

Patients leave doctor visits confused. Research shows retention decreases with information volume. No mechanism to revisit discussions or ask follow-up questions grounded in actual visit data.

MetricCount
API endpoints111
AI services15
Vue components~30
DB migrations22
Feature tests262 (797 assertions)
Versioned prompts14
Clinical scenarios12
Commits349
Vue 3 SPA (patient + doctor views, Sanctum auth) | SSE streaming Laravel 12 (PHP 8.4) — 111 endpoints, 19 modules | 15 AI Services → Claude Opus 4.6 | | PostgreSQL 5 Medical APIs (FHIR-aligned, (OpenFDA, RxNorm, DailyMed, UUID PKs) NIH Clinical Tables, PubMed)

Pattern: 8-Layer Context Assembly

Each patient interaction assembles context across structured priority layers:

LayerContentCacheable
1. System PromptVersioned markdown from prompts/Yes (5m TTL)
2. Clinical GuidelinesESC/AHA/NICE guidelinesYes (5m TTL)
3. Visit DataSOAP note, transcript, observationsNo
4. Patient RecordDemographics, allergies, medicationsNo
5. Health HistoryObservations 1-3 months, as trendsNo
6. Recent VisitsLast 3-5 visit summariesNo
7. Device/WearableApple Watch: HR, HRV, activity, sleepNo
8. FDA Safety DataAdverse events, drug labels (cached 24h)Partially

Every assembly call populates $tokenBreakdown — emitted to frontend via SSE for real-time cost visibility. Typical request: 60K-180K tokens.

Takeaway

Structure context in priority layers, don't dump everything. Track token usage per layer. Cache what's stable.

Pattern: Prompt Caching (78% Token Savings)

Stable blocks cached with CacheControlEphemeral (5m TTL). System prompts identical across requests. Cache read tokens count at 10% of input. First request creates cache (~10K tokens), subsequent requests read at ~1K tokens.

Pattern: Raw cURL Streaming (SDK Bypass)

Problem: Anthropic PHP SDK uses PSR-18 sendRequest() which buffers entire response. Streaming latency was 8-10s.

Solution: Raw curl_multi_exec with progressive SSE parsing. Yields thinking and text deltas immediately. Result: under 100ms per token. X-Accel-Buffering: no for nginx compatibility.

Pattern: Adaptive Thinking Budget

Regex-based effort classification — no AI needed for routing:

EffortPatternsBudgetLatency
Low"what is", "when is", "appointment"512 tokens~1-2s
Medium(default)1,024 tokens~3-5s
High"interactions", "side effects"2,000 tokens~5-10s
Max"chest pain", "can't breathe", "suicidal"4,000 tokens~10-15s

Safety patterns always match first. Regex handles 90%+ correctly.

Pattern: Tool-Use Agentic Loop

3 medical tools available during conversations:

ToolData SourceReturns
check_drug_interactionOpenFDACo-reported adverse events + label interaction warnings
get_lab_reference_rangeLocal JSONStandard clinical ranges
get_drug_safety_infoOpenFDA + DailyMedBoxed warnings, adverse reactions, dosing

Agentic loop runs up to 5 iterations. Plan-Execute-Verify pipeline validates clinical responses against evidence.

Other Notable Patterns

Development Timeline

DayLocationKey Work
1HospitalResearch + scaffold, 67 tests by midnight
2Hospital wardFirst clinical eval with real patients
3-4Cath labCoding between coronarography procedures
5-6Brussels → SF flightIn-flight coding, demo video
7San FranciscoFinal polish, submitted 3:00 PM

What Makes This Exceptional

04

Conductr

Problem

Musicians want AI collaboration during live performance and composition — but current AI music tools are offline batch processors. No tool exists for real-time, latency-sensitive AI interaction with live musical input.

Conductr is a real-time AI music collaboration tool. The musician plays — chords, melodies, rhythms — and Claude responds with complementary musical parts in real-time. Not generating music from text prompts. Actual musical dialogue.

MIDI Input (WebMIDI API) ↓ real-time C/WASM Audio Engine (low-latency DSP) ↓ Claude API (musical analysis + response generation) ↓ Multi-track Output (synthesized instruments)

Why C/WASM: JavaScript's garbage collector creates audio glitches. C compiled to WebAssembly gives deterministic, low-latency audio processing in the browser — no GC pauses, no buffer underruns.

Key Technical Decisions

Patterns Worth Noting

PatternDescriptionReusable When
WASM for latency-critical AIC → WebAssembly for deterministic timingReal-time AI (gaming, robotics, live media)
Phrase-level bufferingAccumulate input into meaningful chunksAI needs context but latency matters
Musical quantizationAI output snapped to temporal gridAny time-aligned AI generation
Note

No public repo available. Architecture details reconstructed from Anthropic announcement and hackathon presentation coverage. This section will be expanded when the repo goes public.

Why It Won Creative Award

05

everything-claude-code

Not an app — infrastructure. A production-grade configuration system for Claude Code: 14 agents, 56+ skills, 33 commands, hooks, rules, MCP configs, and AgentShield security framework. Cross-platform (Claude Code, Cursor, OpenCode, Codex). 50K+ stars, 6K+ forks.

MetricCount
Specialized agents14
Domain skills56+
Slash commands33
Hook event types7 types, 10+ validators
Language rule families6 (TS, Python, Go, Swift, C++, Java)
MCP server configs14
Security rules (AgentShield)102

Pattern: Agent Specialization

14 agents, each scoped to a domain with specific tools and model preferences:

AgentPurposeModel
plannerFeature decomposition + risk analysisOpus
architectSystem design + scalabilityOpus
code-reviewerQuality + security reviewSonnet
security-reviewerVulnerability detectionOpus
tdd-guideTest-driven developmentSonnet
build-error-resolverCompilation fixesSonnet
e2e-runnerPlaywright test generationSonnet
refactor-cleanerDead code removalSonnet
doc-updaterDocumentation syncSonnet
database-reviewerPostgreSQL/Supabase optimizationSonnet
go-reviewerGo-specific reviewSonnet
python-reviewerPython qualitySonnet
chief-of-staffOrchestration + delegationOpus

Key design: Agents fire proactively based on context. Code just written? code-reviewer fires. Build failed? build-error-resolver fires. Opus for thinking, Sonnet for execution.

Pattern: Hook-Based Enforcement (100% vs ~80%)

Rules say "don't push without review." Hooks guarantee it. The core insight: prompts get ~80% compliance. Hooks get 100%.

PreToolUse Hooks (block or warn)

HookBehavior
Dev server blockerBlocks npm run dev outside tmux
Git push reminderReminds to review before push
Strategic compactSuggests /compact every ~50 tool calls

PostToolUse Hooks (react after)

HookBehavior
Prettier formatAuto-formats JS/TS after edits
TypeScript checkRuns tsc --noEmit after TS edits
console.log warningCatches debug statements

Lifecycle Hooks

EventPurpose
SessionStartLoad previous context, detect package manager
PreCompactSave state before context compaction
SessionEndPersist state + extract reusable patterns
StopAudit for leftover debug statements

All hooks in Node.js (not bash) for cross-platform compatibility. Exit code 2 = block.

Pattern: AgentShield (102-Rule Security Audit)

Purpose-built security framework for AI agent configurations. Different threat model than traditional app security:

ThreatAgentShield Response
Hardcoded secretsScan source for API keys, passwords, tokens
Prompt injectionDetect malicious instructions in external content
Path traversalValidate file path access boundaries
Supply chain attacksAudit dependencies and MCP servers
Privilege escalationRestrict shell execution access
Transitive injectionFlag compromised external documentation

Multi-layer defense: Tool permissions → Path restrictions → Sandboxing → Rules + validation.

Pattern: Skills as Knowledge Codex

56+ skills organized as markdown knowledge bases — not executable tools. They provide methodology, patterns, and step-by-step procedures. Categories: coding standards, framework patterns, database, DevOps, business, architecture.

Skills are read-only. They shape how agents think. Version them in git. Review them in PRs. Never hardcode knowledge into agent prompts.

Pattern: Continuous Learning Pipeline

Session ends
    ↓ evaluate-session.js (SessionEnd hook)
Pattern extraction
    ↓
Instincts written to ~/.claude/instincts/
    ↓
Next session loads instincts
    ↓
/evolve command clusters + organizes

Markdown-as-database: All state stored as markdown files. Human-readable, git-trackable, zero dependencies.

Pattern: Multi-Platform Installation

TargetInstall PathMethod
Claude Code~/.claude/install.sh typescript
Cursor./.cursor/install.sh --target cursor
OpenCode./.opencode/Plugin system
Codex./.codex/Compatibility layer

Also available via npm: npx ecc-install typescript python golang

What Makes This Exceptional