Agent Sully

• 

  Agentsully is ready

Inspiration

Most agent demos show an LLM taking an action and asking you to trust that it worked. We wanted the opposite: an agent whose every claim — every dollar saved, every human approval, every rejected forgery — is provable after the fact, not just logged. If the agent says it saved $8,000, you should be able to replay the exact chain of events that produced that number and verify it yourself.

What it does

Agent Sully closes a real B2B vendor-renewal negotiation end to end — baseline, offer, outbound send, counterparty reply, and a final settlement or halt — with every step appended to an in-memory, hash-chained ledger. Nothing is trusted; everything is re-derived.

• A commitment-level classifier gates outbound offers: anything scoring ≥3 on a 0–5 scale requires a human_ack event on the ledger before it can dispatch. No ack, no send.
• An adversarial counterparty model checks outbound offer text for pressure tactics, inconsistent figures, and leverage language before it goes out.
• The plant's reply is validated against a freshly recomputed response — a forged or inconsistent reply is refused outright, not appended.
• Settlement savings are recalculated independently at read time, every time — a tampered savings_usd field is caught and zeroed, not trusted.
• Google ADK wraps the whole path: LlmAgent/SequentialAgent objects whose tools call the real, audited pipeline — the model reports the ledger's output, it never invents a savings figure.

Three fixtures prove three real outcomes: a clean settlement ($8,000 saved), a halted counter-offer that violated a term constraint, and a flat vendor rejection — each producing a distinct, independently verifiable hash chain.

How we built it

The system is a Python control loop, not a prompt chain: an in-memory append-only ledger with SHA-256 hash chaining, a five-stage triage gate, a commitment-gradient classifier, and a fail-closed validation layer on every event type — offers, replies, halts, and human acknowledgements all refuse malformed or unverified input rather than silently accepting it. Google ADK sits on top as the agent orchestration layer, with tools that call into this same audited path.

Challenges we ran into

The hardest problems weren't the happy path — they were the edges. Independent verification during development caught a real gap where a human approval granted for one negotiation could silently authorize a different, unrelated one on a shared ledger; that's now scoped to the specific offer it approves. We also found and fixed a case where an Enum value was silently serializing to an empty object instead of its name — a bug that would have quietly corrupted every audit record's route field.

What we're proud of

Every number in this submission's demo packs was independently recomputed from raw ledger payloads using the actual hashing function — not just read and trusted. The three demo fixtures (settlement, halted counter-offer, halted rejection) were run live and verified cryptographically, not just described.

What's next

Scoping the adversarial check beyond single-message assessment to real cross-event negotiation history, and moving the ledger from in-memory to a persistent backend for multi-session negotiations.hat we're proud of

What we learned

Verifying your own output matters as much as producing it. Several real bugs only surfaced when a claim was independently re-checked instead of trusted — including a security-relevant gap where a human-approval event wasn't scoped to the specific negotiation it was meant to authorize.

What's next for Agent Sully

Extending the adversarial check to reason over full negotiation history instead of a single message, and moving the ledger to a persistent backend so multi-session negotiations can be resumed.

Built With

• chatgpt
• claude
• gemini
• google-adk
• google-cloud
• grok
• pydantic
• pytest
• python