Inspiration
Lost property often becomes a routing problem before it becomes a search problem. Heathrow separates terminal lost property from items left onboard an aircraft, while National Rail routes reports through the responsible station or train operator. A claimant may therefore need to guess who has custody before anyone can search successfully.
Found Roll treats that gap as a coordination problem. Instead of giving an AI permission to decide ownership, it lets a bounded agent move an investigation forward while policy and accountable staff retain authority.
What it does
Found Roll creates one Item Passport across three fictional custodian systems: Grand Hall, Metro Loop, and Northport Air.
Staff authorize analysis of a fixed, provenance-linked evidence packet. A bounded Case Analyst examines only that packet and proposes one source-linked, non-leading private question. The claimant answers through a case-specific one-time link without seeing the expected answer or restricted candidate media.
Deterministic code checks the evidence. Valuable items still require staff identity attestation and supervisor approval. A background Cloud Task then coordinates a permanently labeled SIMULATED Relay Post. The completed Item Passport contains a hash-linked nineteen-event application record.
The public Judge Walkthrough is deliberately read-only and redacted. It demonstrates the completed synthetic case without exposing claimant evidence, credentials, private media, task bodies, or model traces. Please check the demo or the public repo if you'd like to test the full flow :).
Why it is agentic
Found Roll is not a chatbot around image similarity. After staff authorize a derived evidence preview, the service queues an asynchronous investigation. The Google ADK analyst uses permission-scoped tools, returns a typed proposal, pauses for private evidence and human approval, and lets the durable workflow resume afterward.
The analyst may inspect evidence and propose the next question. It cannot accept a claim, attest identity, approve release, issue credentials, or change custody. Those decisions remain in deterministic policy and authenticated human gates.
How I built it
The Case Analyst uses Google Agent Development Kit and the Google Gen AI SDK with Gemini 3.5 Flash through Vertex AI.
The application runs on two Cloud Run services: the Found Roll application and the explicitly simulated custodian/relay service. Firestore stores cases, events, versions, outbox records, and idempotency state. Cloud Storage separates restricted originals from model-authorized derivatives. Cloud Tasks performs named, authenticated background delivery. Secret Manager holds deployment credentials, and Cloud Logging records redacted operational correlation.
The interface uses React and Vite. The API and policy engine use Python, FastAPI, and Pydantic.
Challenges I ran into
The first challenge was requesting useful evidence without leaking the correct answer. I separated public and restricted projections, gave the model an attribute identifier rather than the expected value, and used one-time, case-version-bound claimant links.
The second was keeping Gemini useful without granting it release authority. Candidate eligibility, exact evidence comparison, identity, approval, and custody transitions are all deterministic.
The third was handling retries honestly. Cloud Tasks and callbacks may arrive more than once, so Found Roll uses deterministic task names, expected state versions, idempotency fingerprints, one-time credentials, and an outbox/reconciliation workflow.
Finally, I wanted to demonstrate coordination without pretending I had real airport, transit, or courier partnerships. Every custodian and item is fictional, and Relay Post is permanently labeled SIMULATED.
Accomplishments that I'm proud of
I built a deployed end-to-end synthetic recovery workflow that progresses from evidence analysis to a closed Item Passport while keeping claim and release authority outside the model.
The public walkthrough exposes a safely redacted completed case, real Vertex ADK execution metadata, five retained tool steps, and an internally checkable nineteen-event manifest.
The deterministic evaluation suite passes all sixteen synthetic scenarios, including abstention, expired-link, prompt-injection, and replay behavior. These results test the workflow boundaries; they are not presented as real-world recovery accuracy.
What I learned
A carefully selected private discriminator can be more useful than another similarity score. I also learned that an eligible candidate, accepted claim evidence, and authorization to release are three separate states with different owners.
A hash-linked event record can reveal internal inconsistency, but it cannot prove legal ownership, identity, physical possession, or an actual handoff. That distinction is visible throughout the product.
What's next for Found Roll
The next step would be one real pilot with a venue, campus, or multi-building operator and a single production integration. Before accepting real claimant data, Found Roll would need production identity management, retention and deletion controls, monitoring, operator-specific policies, and a formal security and privacy review.
Data sources and third-party work
All case records, custodians, routes, claimant information, and item photographs are fictional or synthetic. No real claimant or lost-property dataset is used.
The product was informed by public recovery guidance from Heathrow, National Rail, and LostProperty.org. Synthetic fixture images were generated specifically for the project using OpenAI's image-generation tooling.
The project uses open-source packages including Google ADK, Google Gen AI SDK, React, Vite, FastAPI, Pydantic, Phosphor Icons, and QRCode React. Licenses and notices are documented in the repository.
Log in or sign up for Devpost to join the conversation.