AupaZu

An agent that finds public grants for small shops, asks what's missing over WhatsApp, and drafts the application with citations — but never submits: a human always does.

Comment

Inspiration

Small retailers miss public money — not because grants don't exist, but because eligibility rules live in dense PDFs, deadlines are short, and a two-person bakery has no grants department. In the Basque Country, where our pilot city Vitoria-Gasteiz sits, programs like the MEC 2026 modernization grants publish real money with real friction attached.

We wanted an agent that does the heavy lifting — watching, matching, asking, drafting — while being honest about the one thing it must never do: submit on someone's behalf.

What it does

AupaZu is an event-driven pipeline with a human gate at the end:

  1. A Cloud Scheduler job (HTTP + OIDC) wakes the system every morning.
  2. New grant calls are detected and normalized into a typed graph.
  3. A matcher scores each call against each merchant's profile.
  4. If a fact is missing — say, the investment amount — a Gap Analyst agent asks exactly one question over WhatsApp, in plain language.
  5. The reply updates the profile; the eligibility explanation is regenerated, and every claim carries a citation ID pointing to the official source.
  6. A Draft Builder produces a versioned draft: confirmed facts only, gaps as visible [PENDING: field] markers, and a fixed label — "DRAFT: AupaZu does not submit the application; human review is mandatory."

The full cycle — scheduler to draft — takes about 85 seconds.

How we built it

Built with Gemini 3.7 Flash on Vertex AI and Google Cloud end to end: Google ADK orchestrates six small agents (Fetcher, Normalizer, Matcher, Synthesizer, Gap Analyst, Draft Builder) across two Cloud Run services — a private brain and a public webhook Meta can reach. Pub/Sub carries domain events (grant.detected, message.received, match.ready, merchant.profile.updated), each with an event_id for idempotency and a correlation_id that survives the whole journey — visible in Pub/Sub, in Cloud Run logs, and in the case file itself. Supabase/PostgreSQL is the system of record with versioned migrations; Secret Manager holds every credential behind a least-privilege service account; the WhatsApp Cloud API is the channel to the merchant.

Governance is treated as a feature: no submit button exists anywhere, the system of record stores a reference token instead of phone numbers, every demo merchant is flagged is_demo: true in the database itself, and the repo keeps a written list of nine known debts.

Challenges we ran into

The freeze caught what our test suite didn't. Our acceptance criterion — two consecutive end-to-end runs under five minutes, no manual retries, console evidence — surfaced two blocking bugs: a database CHECK constraint that rejected the canonical event name merchant.profile.updated, and a webhook validator that answered 403 to legitimately signed Meta callbacks. Both were fixed with migrations, re-verified, and documented with their commit hashes.

The other battle was calendar, not code: provisioning a real business phone number through Telnyx and registering it with Meta took long enough that the freeze demo ran on the WhatsApp test number instead.

Accomplishments that we're proud of

  • The freeze criterion was defined before we ran, and met in public: two consecutive end-to-end runs — 1 min 25.6 s and 1 min 16.8 s — with no manual retries and console evidence linked from the repo.
  • The freeze itself found the bugs: two blocking issues surfaced, were fixed with evidence, and are documented with their commit hashes.
  • Zero invented facts: every eligibility claim carries a citation ID, and every gap in a draft is a visible marker, never a guess.
  • Privacy that survives an audit: the system of record holds a reference token, not a phone number — verifiable by looking at a single database row.
  • Governance you can read: an AGENTS.md operating contract, demo data flagged in the database, and a nine-item known-debt list written down instead of forgotten.

What we learned

  • Observability designed for operations turned out to be the best demo material: one correlation ID, filterable logs, saved queries.
  • A written debt list builds more trust with reviewers than claiming completeness.
  • Next time, specs live in the repo from day one — retrofitting governance works, but costs double.
  • External dependencies (telephony providers, platform verification) belong in week one, not in the final sprint.

What's next for AupaZu

  • The Vitoria-Gasteiz pilot with real merchants: the business number is already provisioned and registered with Meta; moving from the test number to production is the first post-hackathon step.
  • Paying down the nine known debts, starting with dead-letter queues, IAM scope, and scaling the webhook consumer to zero.
  • More programs, more regions: the typed-graph model generalizes beyond MEC 2026 to other Basque and Spanish grant calls.
  • Keeping the human gate non-negotiable: the roadmap brings advisors and gestorías into the review loop — the draft stays automatic, the decision stays human.

Links and bonus materials

Built With

Share this project:

Updates

Submission history