• 

• 

  Architecture Diagram

• 

  Live hosted console: a prompt-injected doc is blocked at the door by Model Armor — even the rejection carries cryptographic evidence ids.

• 

  A second agent recalls the review's findings from Memory Bank and generates training named for the exact gap found — with ledger receipts.

• 

  Content-free observability: pollard spans nested in Cloud Trace — ids and digests only. No queries, no documents, no vendor names.

• 

  Our real Gemini review, sealed and committed, re-run offline from a clean clone — model and DB provably unreached. Same digest. 1 passed.

• 

  One click, zero humans, 2 min: screened, reviewed, risk-scored, approved, onboarded — every step timestamped, every step receipted.

Inspiration

Anyone who has shipped software into an enterprise knows the vendor-review purgatory: a security questionnaire disappears into a queue, a human cross-references a SOC 2 against a pen test that may be two years stale, approval arrives by email with no trail, and then nobody ever tells the staff what the review actually found. The training they get on day one is generic; the risks the reviewer flagged evaporate.

Agents are obviously suited to this work. But the workflows that most need autonomy are exactly the ones where "the model said so" is unacceptable. Our inspiration was a fleet a compliance officer could love: one you can leave alone, and also cross-examine. Three ideas anchored it:

Firestore finds what's similar; chronofy decides what's still true enough to rely on; pollard proves what was consulted.

What it does

Gatehouse runs a vendor's entire lifecycle from one HTTP door, unattended:

1. Intake (Cloud Run): Model Armor screens every document inline, fail-closed. A prompt-injected document gets a 403 with a cryptographic receipt. Try it yourself on the live console.
2. Review fleet (Agent Engine): security → DPA/legal → synthesis. Retrieval is temporally validity-gated, every search is a content-addressed ledger node the findings cite, and risk is scored by an auditable formula.
3. Approval gate: risk ≤ 0.7 publishes vendor-approved; anything else is held for a human. Fail-closed.
4. Enablement (Agent Engine): recalls the review's findings from Memory Bank and onboards the vendor with training conditioned on the exact gaps found. The review flagged weak MFA on a legacy tier, so the generated module is literally "MFA Setup for Acme SaaS Inc. Legacy Tier" (conditioned_on: ["CC6.1", "DPA §7.1"]). Three registered actions write real receipts; approve_vendor is not a registered action and never will be, so attempts become REFUSAL nodes.

Underneath everything: a pollard evidence ledger. Every model call, tool call, verdict, and refusal is a content-addressed node; every closed run is sealed (rolling SHA-256 + custody log); telemetry streams to Cloud Trace content-free (ids and digests, never documents or queries). The committed golden review replays offline from a clean clone with zero credentials, Gemini and Firestore provably unreached, landing on the identical result and seal digest:

pytest --pollard-mode=replay

How we built it

We started backwards: before writing a line of the fleet, we ran a seven-component availability audit of the GEAP platform (Registry, Runtime, Memory Bank, Identity, Gateway, Model Armor, Observability): tiny scripts proving each surface worked on our account, with findings logged. That audit paid for itself a dozen times. By submission, all 7/7 components aren't just "available," they're carrying production traffic.

The build is SOLID by construction: each agent has one job; the system extends by registering Services and ActionSpecs, never by editing the orchestrator; any «Reviewer» substitutes (the offline replay literally swaps the model); every action has a strict JSON schema with additionalProperties: false. The stack: Gemini 3.5 Flash for all five agents and gemini-embedding-001 (768-dim) for Firestore native vector search; Google ADK (SequentialAgent + callbacks, deployed with adk deploy --extra_packages); Cloud Run, Pub/Sub, Model Armor, Memory Bank, Cloud Trace.

The evidence plane runs on two open-source libraries that Muntaser authored before the hackathon: pollard (the content-addressed evidence ledger, with its action registry, seal, and replay) and chronofy (temporal validity). Gatehouse is their first production integration; everything that wires them into the fleet, the intake, and the enablement agent was built this week.

chronofy's gate is one line of math doing an auditor's job: per-fact-type exponential decay against a pinned as-of instant.

$$validity(t) = e^{-\beta_{\text{fact}}\,\Delta t}$$

A clean-but-18-month-old pen test decays to $0.35 < 0.5$: pruned, and the reviewer files an EVIDENCE-STALE re-acquisition finding instead of silently trusting it. Policy clauses get $\beta = 0$: contracts don't decay.

Two of us built in parallel on a deliberately slim CI (lint + offline tests only; heavy deps lazy, importorskip everywhere, scripted-LLM harnesses driving the real agents through ADK's runner). When we accidentally built phase 2 twice in parallel, the merge rule "one implementation is canonical; port the missing capability" resolved it in an evening. The seal ported onto the canonical enablement agent without an interface change.

Challenges we ran into

Almost every cloud failure was an identity or addressing seam, never logic. The full write-up, with fixes, is on dev.to: Every Bug Was an Identity Bug.

• Endpoint topology is bimodal: Gemini + embeddings serve on the global endpoint (regional 404s); platform services are regional. Model Armor's CLI returns a misleading PERMISSION_DENIED unless you override the regional endpoint.
• Agent Engine's ambient GOOGLE_CLOUD_PROJECT is the project *number; Firestore's default-database routing needs the *ID. Our first deployed run died on a database that "didn't exist," in a project we'd been querying all week.
• Dev credentials mask identity bugs: the engine's runtime service agent needed its own datastore.user grant; every prior Firestore call had run as a human.
• Cold starts as a feature: the enablement engine 429'd three deliveries on its very first activation, and because the dispatcher acks only after completion, retry #4 finished the first fully autonomous lap unattended. The at-least-once design is the autonomy.
• Small sharp edges: Firestore's 2048-dim vector cap vs. the embedding model's 3072 default (pin 768 at write and query); floats are illegal in pollard identity payloads (the verdict is noted as JSON text), a constraint that later made bit-for-bit replay possible.

Accomplishments we're proud of

The first autonomous lap completed itself via retry after two real faults. The memory bridge produced a training module named after the review's own finding. An injected approve_vendor becomes a REFUSAL node, live, not just in a spike. And a judge can reproduce our real review today, offline, for $0, to the exact seal digest.

What we learned

Autonomy you can't audit is a demo; autonomy you can cross-examine is a product. Determinism discipline (one pinned as-of time per review, no floats in identity, content-addressed everything) is cheap while you build and priceless when someone asks you to prove it. And in cloud agent systems, debug the who and the where before the what. The logic was never wrong once.

What's next

Human-in-the-loop mode via pollard's confirm() on side-effectful actions (the demo runs autonomous by choice); the Agent Identity denied-read demo; redact() for PII-bearing corpora; Gateway config authoring; multi-vendor fleets sharing one evidence plane.

Built With

• agent-engine
• agent-registry
• chronofy
• cloud-run
• cloud-trace
• firestore
• flask
• gemini
• google-adk
• google-cloud
• memory-bank
• model-armor
• multi-agent
• opentelemetry
• pollard
• pub-sub
• pytest
• python
• vector-search
• vertex-ai