Cargo Release

• 

  Authority map: authenticated intake, four scoped ADK workers, one Cloud SQL writer, independent receipts, and physical release.

• 

  A validated rejection scan causes security-pack v2 while hostile email text is quarantined and cannot change trusted state.

• 

  Prompt-injection email quarantined with zero facts, memory, or transitions while the synthetic cargo remains HELD.

Inspiration

After a General Average casualty, undamaged cargo can remain held while an owner, insurer, adjuster, and carrier exchange evidence and authority. We wanted agents to remove that coordination burden without quietly becoming the decision-maker.

What it does

Cargo Release turns one synthetic casualty event into a receipt-gated release mission. A prepared scan follows a typed extraction-and-validation contract while a hostile email is quarantined. One human attests the owner bond; the fleet then submits security, preserves the v1 rejection, produces v2, and collects signed insurer, adjuster, and carrier receipts. Cargo opens only after adjuster acceptance and an independent carrier read-back. The adjustment remains open. The public demo truthfully labels its extraction fixture; its managed Gemini adapter is staged and fails closed.

How we built it

Gemini 3.5 Flash and ADK coordinate four tool-scoped workers. Pub/Sub and Eventarc open an idempotent mission on Cloud Run. A private FastAPI controller is the sole Cloud SQL writer. The visual adapter and disclosed production fixture share one typed, zero-authority receipt contract; deterministic policy validates its digest, schema, case, container, revision, checkbox, and confidence. Identity-bound partner services issue signed receipts. Next.js renders the held/released bay, evidence, revisions, receipts, traces, and live Authority Map.

Challenges we ran into

The hard part was separating useful model output from authority. We also had to make duplicate events, concurrent resumes, stale versions, bad signatures, low-confidence scans, and prompt injection fail closed without making the demo unreadable.

Accomplishments that we're proud of

• One attestation produces eight duplicate-safe downstream actions.
• A valid image changes v2; hostile text changes nothing.
• Five issuer-bound receipts and a two-key rule - not model prose - open the container.
• Every transition remains reconstructable from Cloud SQL state, hashes, identities, and traces.

What we learned

Agent autonomy is more credible when its limits are visible. Structured model receipts, deterministic validation, durable rejection reasons, and independent authority make a failure path more persuasive than a perfect happy path.

What's next for Cargo Release

Activate and prove the managed Gemini visual extractor, add more partner adapters behind the same receipt contract, and extend the open adjustment monitor without expanding model authority.

Upstream contribution

Building Cargo Release surfaced a documentation defect in Google ADK's Express Mode guide: the published example constructs deprecated vertexai.Client, which emits a FutureWarning with google-cloud-aiplatform[agent_engines] 1.165.1. We verified that agentplatform.Client removes the warning while retaining the released client.agent_engines API, then submitted a narrow docs fix validated by mkdocs build --strict. google/adk-docs#2187.

Built With

• agent-gateway
• agent-identity
• agent-registry
• cloud-logging
• cloud-run
• cloud-sql
• cloud-trace
• eventarc
• fastapi
• gemini-3.5-flash
• gemini-embedding-2
• gemma-4
• google-adk
• memory-bank
• model-armor
• next.js
• postgresql
• pub/sub
• python
• veo-3.1-fast
• vertex-ai-agent-runtime