DiligenceCloser

autonomous M&A due-diligence agent that rejects deficient evidence, requests corrections from the counterparty, waits asynchronously, and resumes on its own. Diligence that closes itself.

Comment

Inspiration

I've seen evidence-chasing as being a major friction point in fintech compliance work. Closing a deal or an audit means days, if not weeks, of cross-checking data-room documents against a checklist. With cascading mundane tasks such as rejecting the wrong fiscal year for the third time, and emailing the counterparty again about a certificate that expired last month filling the time. The waiting is the job. DiligenceCloser is the agent I see that could hop in that seat and free us from .

What it does

DiligenceCloser is an autonomous M&A due-diligence analyst that closes the loop instead of just reporting on it:

  • Validates evidence with auditable math - Gemini finds the right documents and tables; deterministic code computes the numbers (concentration %, expirations, cross-document contradictions); a canonical normalizer locks every verdict into a strict four-state machine. Care though, as the LLM never gets the last word on a number.
  • Chases what's missing - When evidence is deficient, it drafts the deficiency notice to the responsible party, schedules a reminder, and checkpoints state to Firestore.
  • Closes the loop by itself - Every notice carries a signed, single-use response portal link. When the counterparty uploads the corrected document, the Pub/Sub event wakes the checkpointed workflow, a field-level resubmission diff shows exactly what changed, and the requirement resolves with no operator in the loop.
  • Reads real documents defensively - Uploaded PDFs go through multimodal understanding into typed schemas; extraction has no verdict field by construction, preventing documents from prompt-injecting their own approval (proven by included adversarial fixture tests).
  • Shows its work - A live-streaming, hash-chained action timeline (verifiable via an offline script), cell-level provenance, and an exportable Diligence Memo PDF.
  • Turns prose into rules - Paste any raw checklist and the agent parses and structures it into machine-checkable requirements.

How it was built

  • Gemini 3.6 Flash via the Gemini API for document reasoning, multi-turn synthesis, and deficiency notice drafting.
  • Google ADK LlmAgent with Zod-validated tool contracts (searchDataRoom) runnable end-to-end — the agent orchestrates tool calls while deterministic server engines validate and commit outputs.
  • Cloud Run hosting the Express backend API and React UI.
  • Firestore for persistent workflow state checkpointing (WAITING_EXTERNAL), live action-log streaming, and usage rollups.
  • Cloud Pub/Sub for document-arrival and lifecycle events with OIDC-verified, identity-pinned push endpoints.
  • Gemma routing (gemma-4-31b-it): A Gemma model classifies incoming document types before deep Gemini extraction—small model routing into the observable timeline, with zero new failure modes when unavailable.
  • Hermetic Test Suite: A deterministic test harness providing 160+ offline tests and a zero-cost dev:replay mode that lets judges verify the entire flow in under two minutes without live cloud spend.

Data sources

The seeded project data room is synthetic - real deal rooms are confidential by definition. Everything that runs is live: real Gemini calls, real Pub/Sub triggers, and Firestore checkpoints. The ingestion path accepts arbitrary real documents, uploads any real annual-report PDF and watch the auditor, period, and audit status get extracted live.

Challenges

  • LLM nondeterminism vs. audit-grade output: Built a dual-layer verification engine with a canonical status normalizer that strictly overrides model verdicts (e.g., an expired certificate stays WAITING_EXTERNAL even if the LLM claims RESOLVED).
  • Cloud Run header stripping: Handled Cloud Run proxy behavior with dual-path webhook authentication: application-level OIDC verification for genuine Google Cloud Pub/Sub push events and strict rejection everywhere else.
  • Distributed correctness under concurrency: Handled idempotent state commit claims, atomic event deduplication before validation, cross-instance portal token CAS (Compare-And-Swap), and reset generations to guarantee exactly-once commits across duplicate webhooks, racing uploads, and mid-flight deal resets.

Accomplishments

  • Live-verified asynchronous resumption over real Cloud Pub/Sub that closes the compliance loop with zero manual operator clicks.
  • A tamper-evident, cryptographically hash-chained audit timeline with an independent offline verifier.
  • Adversarial injection test fixtures proving extraction safety boundaries.
  • 160+ offline tests with an automated guarantees table generated directly from the test suite.

What was learned

"Agentic" is fundamentally an accountability problem, not just a capability problem. The model is rarely the bottleneck; trustworthiness comes from the scaffolding around it: deterministic state machines, provenance chains, fail-loud modes, and treating every ingested document as an untrusted input. Additionally, recording deterministic cassettes turned a costly cloud debugging loop into a fast, repeatable local workflow.

What's next

  • Entity matching across cross-deal entity graphs.
  • Direct email and Slack notification bridges for outbound deficiency events.
  • Expanded multimodal parser support (complex spreadsheets, multi-page commercial contracts).
  • Integration with external government registries (e.g., USPTO for IP diligence).

Built With

Share this project:

Updates

Submission history