-
-
Two days in, someone should check whether the antibiotic is still right. In a small hospital with no specialist, that review gets missed.
-
The gap is not missing programs. It is execution depth: 97% meet the Core Elements, only 16% meet the newer priorities.
-
Read the report, build the local picture, sleep until the review falls due, then hand a pharmacist something they can check.
-
Four guided steps against the live service. Disabled controls enforce the order, and every state change is real, not a recording.
-
Three cultures come in and the local resistance picture builds. Cells with too few samples show no percentage rather than a false one.
-
The walkthrough replays a saved answer and fast forwards a clock, and says so. These three checks run for real, right now, with no sign up.
-
A job booked on the real clock, claimed by a scheduled worker while nobody watched. Nothing on the page can move it, only time passing.
-
Other departments can find the agent. Finding it is not permission. Without the scope the call is refused, and the refusal is recorded.
-
Name a workspace and press the button. No invitation and no account. The key is scoped to that workspace and expires in seven days.
-
Send your own report through the same workflow. Every value comes back with the line it was read from, and the model that answered is named.
-
Put a patient name and a record number in, and it refuses before the model is ever called, naming the identifier types it detected.
-
Really deployed. Cloud Run in us central one, scaling to zero, with Cloud Scheduler running the background wakes.
-
Live running on Google cloud us-central1
Inspiration
If you're admitted with a serious infection, treatment starts before anyone knows which bacteria it is. Two days later the culture comes back, and it often shows a narrower antibiotic would be appropriate. Someone has to notice.
We assumed small hospitals lacked stewardship programs. The research said otherwise. The CDC's 2025 stewardship update reports 97% of acute-care hospitals meeting all seven Core Elements, but only 16% meeting all six newer priorities. The gap isn't programs. It's execution depth.
Two studies sharpened it. A 21-program evaluation found that of 20 respondents, 15 cited time and personnel and 8 cited expertise as barriers. A process evaluation across 19 critical-access hospitals found 17 sites collected local data, but none completed a full improvement cycle in a year.
So we stopped trying to build a program, and built the thing a stretched team actually loses: the follow-up. Day Three carries the clock.
What it does
A patient starts a broad antibiotic. Day Three schedules five reviews across 14 days, goes to sleep, and wakes itself when a review is due. Then it prepares a source-quoted draft for a pharmacist.
End to end:
| Stage | What happens |
|---|---|
| Read | Gemini 3.5 Flash transcribes a scanned culture report. Identifiers are stripped before the model sees it, and Gemma 4 does a second privacy pass. |
| Curate | A value is kept only if the model can quote it word for word from its own transcription. Anything it can't point to gets dropped, never guessed. |
| Aggregate | A cumulative antibiogram to CLSI M39, with first-isolate handling. Below the low-count threshold it prints no percentage at all, because small samples are unstable. |
| Wait | Five inpatient wakes through day 14, held in durable Firestore state. Sleeping costs nothing. Discharge cancels the remaining reviews and arms a 30-day readmission check; the last scheduled review closes the course, so the system can say which patients it is still watching. |
| Reconcile | At hour 48, inside the 48 to 72 hour review window, it loads the latest isolate, the course, and the latest openFDA shortage signal, then drafts a recommendation. |
| Verify | Every claim has to quote an observable source line. Fabricated percentages, empty quotes, and claims outside the task are rejected with a reason. |
| Stop | A licensed pharmacist decides. Day Three cannot prescribe, dose, order, page, or change a chart. |
Also built:
- It decides when it does not have enough. When a review comes due and no final culture has arrived, the agent does not guess and does not stall. It registers exactly one more check and, on the next attempt, refuses to register another, so a missing lab result cannot become an endless loop. Press Wake it with no result back twice on the walkthrough and watch it change its mind.
- Prompt-injection quarantine. Instruction-shaped text inside a report is isolated before any model reads it, and shown rather than silently dropped.
- Agent Registry. Eight managed entries: four REST capabilities plus four Runtime projections. Another department can discover the Curator but can't just call it. Wrong scope is denied and durably audited. Correct scope is allowed and invoked.
- Tenant-scoped
/v1API, open to try. Anyone can mint a seven-day sandbox key at/developerwith no invitation and no account, send de-identified text, and get their own private antibiogram back. Different key, different hospital, separate data. The response names the model that answered, taken from the deployment's configuration rather than written into the page, so a live call cannot claim a model it did not use. Keys are hash-only and revocable in one call. That is only safe because the cost is bounded elsewhere: key creation and model calls are each capped per caller and per day on durable counters, so an open form cannot be farmed and a valid key is not a blank cheque. - openFDA shortage watch. The national feed filtered to the demo formulary, refreshed at most once a day, stamped with its source date, never treated as local inventory.
- Memory Bank. A de-identified course handoff that survives across sessions. Firestore stays authoritative.
- A course that can end. Discharge cancels the inpatient reviews that no longer apply and
arms a 30-day readmission check. The last scheduled review closes the course itself, and
GET /day-three/coursesreports the fleet: how many are being watched, how many are finished, and the counts by state. Press Run the two weeks out and the remaining reviews fire in order until the course closes, with no press per review. - Three things you can check yourself, with no credential:
- Read the sample report now. Calls Gemini live, right then, image only, and grades the fresh answer against the same ground truth behind our published score.
- Start a real timer. Books work on the wall clock that nothing on the page can advance. Only the every-minute Cloud Scheduler worker can claim it.
- Ask without permission, then with it. Two live calls to the managed Agent Registry from the page. Without the scope it is refused and written to an audit record; with it, the curator runs and returns the real grid.
Data sources
Everything the system reads, and where it comes from.
| Source | What it is | How it is used |
|---|---|---|
| Synthetic microbiology reports | Composite patients we wrote, including deliberately degraded scans with committed ground truth | The only clinical input. No protected health information exists anywhere in this project. |
| openFDA Drug Shortages | Official US national shortage feed | Refreshed at most once a day, filtered to a six-drug formulary, stamped with FDA's own source date. Never treated as local inventory. |
| CLSI M39 | The published standard for cumulative antibiograms | First-isolate handling and low-count suppression, mapped to executable tests. One deviation is disclosed at /conformance. |
| Peer-reviewed stewardship literature | CDC Core Elements, a 21-program evaluation, a 19-hospital process evaluation, de-escalation timing reviews | Cited inline above, each keeping its population, timeframe and study type. |
How we built it
The fleet is real where it matters: four Agent Runtime resources with four distinct Agent
Identities, all bound to one governed Gateway, published alongside four REST capabilities in
Agent Registry. The orchestration itself runs as nine logical roles inside a single Cloud Run
service in us-central1 that scales to zero. Coordination is the hard part here. Process
boundaries between those roles would have been for show.
- Gemini 3.5 Flash on Vertex AI: transcription-first extraction, schema-validated
- Gemma 4 MaaS: second-pass privacy review, spans only, fails closed
- Gemini 3.1 Flash Image and Veo 3.1 Fast: build-time onboarding media, outside the clinical path, with prompts and SHA-256 hashes published
- Firestore: runs, wakes, claims, leases, idempotency, antibiogram, courses
- Cloud Scheduler: one job scans due work every minute, another refreshes shortages daily
- Agent Registry, Runtime, Identity, Gateway, Model Armor, Memory Bank: read live at
/day-three/platform - Secret Manager: hash-only API key and invitation-code records
- Cloud Trace and Logging with OpenTelemetry: reasoning chains and audit
The keystone is an injectable clock. The same scheduler code runs against simulated time, so a 14-day ladder fits inside a four-minute demo and the page says so, and against wall-clock time in production. Only the reading of "now" changes.
Challenges we ran into
A second service stole our proof. We first built the wall-clock wake on the shared spine wake
table. Another deployment's worker scans that table unfiltered, on its own simulated clock, so it
claimed our wake and completed it with its handler. The wake read done while the proof
silently never fired. A proof another service can consume isn't a proof. It now owns a private
due-work table that only we scan.
We got a published clinical rule wrong, and the standard caught it. CLSI selects the earliest
isolate by collection date. We kept the first one ingested. Counts stay correct, but the selected
profile can differ when reports arrive out of order. We disclose it at
/conformance rather than
quietly rewording the claim.
Model Armor is fail-closed and we left it that way. Invoking Agent Runtime directly needs a token-sharing exception that has to pass a security review. Our two options were to disable a Google security default so the demo looked better, or leave it enforced and say so. We left it enforced.
Accomplishments that we're proud of
Not the feature count. What we're actually proud of is that a judge can prove us wrong without us being in the room.
| Claim | How you check it |
|---|---|
| "The model really reads the scan" | Press Read the sample report now. Live Gemini call, graded on screen. |
| "The agent wakes itself" | Press Start a real timer. Nothing on the page can advance it. |
| "It works with your data, not just ours" | Mint a key at /developer, send your own report, watch it refuse a patient name. |
| "Discovery is not permission" | Press Ask without permission, then Ask with permission. The refusal and its audit id appear on screen. |
What we learned
The hallucination defence and the prompt-injection defence turned out to be the same code. Both reduce to one rule: a sentence may only reach a human if it quotes something observable. One verifier, two threats.
Standards beat testimonials when a judge can't verify either. We couldn't get a rural pharmacist inside the build window. Rather than a quote nobody can check, we mapped CLSI M39 rules to executable tests. That answers correctness. It does not answer fit to practice, and we say so.
Precision is a feature. Every statistic keeps its population, timeframe and study type. A finding from 19 selected critical-access hospitals is never generalised to all rural hospitals.
What's next for Day Three
- A pharmacist actually using it. The one thing the standards substitution cannot buy.
- Fixing the first-isolate deviation, so selection goes by collection date rather than ingestion order.
- Lifting the Runtime fail-closed through the proper token-sharing security review, rather than around it.
- A real lab feed over HL7 or FHIR, behind the same de-identification gate as
/v1. - Validation before deployment. A real hospital rollout needs that hospital's security, privacy, governance and clinical validation processes. Nothing here shortcuts that.
All demonstration data is synthetic. No protected health information is used anywhere. Day Three is not a medical device, and no organisation endorses it.
Log in or sign up for Devpost to join the conversation.