Selective revalidation: 5 affected, 7 safely skipped of 12. The final map keeps its history — REPAIRED, VERIFIED, SKIPPED.
Five bounded agent roles — and the Independent Verifier stands apart. Runtime facts and invariants, each backed by a named test.
A real boundary: GlassWake reaches Northstar only over authenticated HTTPS. The mutation response is never accepted as proof.
Discovery is not permission. A deterministic gate grants one bounded RepairBrief covering exactly three named synthetic surfaces.
The trigger crumb that woke the fleet: returns policy 30 → 14 days, from the Policy Service. Crumbs justify — never authorize.
Typed evidence, labeled by how it was learned: OBSERVED drift on three surfaces, VERIFIED truth at the sources. Proof, not narration.
One page, whole story: cause, mission, fleet — and a receipt that cannot exist before fresh independent verification.
One real Cloud Run execution — nine phases stamped server-side, receipt sealed last. S0–S8 are just internal fixture aliases.
Proof of action where the problem started: the storefront now reads 14 days — and the product film itself is generated by Veo.

Inspiration

Enterprises don't fail because nobody wrote the truth down. They fail because the truth changed in one place and stayed stale everywhere else. A returns policy moves from 30 days to 14: the policy service knows, the database is updated — but the storefront, the checkout help page, and the support macro keep promising 30. We call it enterprise memory rot. The usual fix is re-running everything on a schedule, which doesn't survive a real estate of systems. We wanted a fleet that wakes only the agents responsible for what might now be wrong — and that can prove it fixed something rather than asserting it.

What it does

GlassWake watches for a change to an authoritative fact and runs a governed repair:

Gemma 4 performs candidate-only triage on the incoming change.
Deterministic dependency selection computes the affected subgraph — 5 nodes affected, 7 safely skipped, of 12.
Three specialist agents inspect their domains and file typed findings into an Evidence Spine where every claim is labeled by how it was come by: OBSERVED, DECLARED, INFERRED, APPROVED, VERIFIED.
A deterministic Authority Gate issues a bounded grant — three named synthetic paths, nothing else.
GlassWake performs a real external action: an authenticated HTTPS mutation against Northstar Supply, a separately deployed Cloud Run service.
An independent verifier re-reads that external service — it never trusts the mutation's own success response.
Only then does the receipt seal. Downstream, Gemini TTS, Lyria, and Veo communicate what happened, with zero authority to change any of it.

Anyone can verify the side effect without us in the loop:

curl https://northstar-sandbox-701830159437.us-central1.run.app/api/v1/products/NST-BAG-001

Before the run: 30 days, version 1. After: 14 days, version 2. A retry returns ALREADY_APPLIED (idempotent). An action aimed at the authoritative policy source is refused with "outside the repair allowlist" and no request ever leaves the process — a refused action produces zero writes.

How we built it

Google stack: Gemini 3.7 Flash via Vertex AI (no API key — Application Default Credentials only), Google ADK orchestration with the GenAI SDK, Cloud Run for execution, Firestore for persistence.

Four additional Google models, each on the correct side of the authority line:

Model	Role	Position
`gemma-4-26b-a4b-it-maas`	Wake Triage	Before the core — candidate only
`gemini-2.5-flash-tts`	Executive voice brief	After the receipt — read-only
`lyria-002`	Executive audio bed	After the receipt — read-only
`veo-3.1-fast-generate-001`	Incident replay + the storefront's 360° product film	After the receipt — read-only

Two services, deployed separately. glasswake-kanon-pulse holds the agent runtime. northstar-sandbox is the merchant with its own state and a public read endpoint, so the repair is provable by anyone.

Architecture as evidence: seven invariants, each enforced at runtime and covered by a named test (docs/CONFORMANCE.md); seven ADRs each naming the alternatives we rejected; and a test suite that reads those documents and fails if any cited test stops existing — the docs cannot silently rot.

Challenges we ran into

Our repair wasn't actually an action. Late on, we checked whether the mutation crossed a service boundary. It didn't — it was an internal state transition rendered as a fix. We extracted Northstar into a separately deployed service with its own credential and idempotency. Only then was the claim true. The single most valuable thing we did.
/healthz is unreachable on Cloud Run. Google's frontend answers that path with a 404 that never reaches the container. Our client validated health first, so it silently fell back to fixtures against every cloud origin. Moved to /v1/healthz.
Firestore doesn't bump updateTime on byte-identical writes. Our deterministic runs write identical documents; we nearly reported the writes as failing. Verified with two identical writes seconds apart — and documented it, because presenting a stale timestamp as fresh-run proof would be wrong.
Model geography: Gemma 4 MaaS is global-endpoint-only; Lyria, Veo, and TTS are us-central1-only; lyria-3-clip-preview is listed but not granted, so we run lyria-002. The derived plane got its own regional client — which made the trust boundary a literal client boundary.
Gemma justified its own guardrail. Asked to triage the change, it returned RETURNS alongside invented watchzones like CUSTOMER_SERVICE. The deterministic validator keeps the real one and names the rest rejected — and a test proves canonical scope is byte-identical whether triage answers well, wrongly, or not at all.

Accomplishments that we're proud of

The separation holds end to end: a model cannot grant authority, evidence cannot elevate permission, the agent that repairs cannot certify its own work, and the API raises rather than serve a receipt before a fresh-verification event exists. We're also proud of what we refused to claim — capabilities that are designed but not built are named as absent in our conformance matrix, not shown as architecture.

What we learned

Verification isn't a step you add at the end; it's a separation you design in. The moment the repairing agent could also report success, the receipt would mean nothing. Making the verifier re-read an external system it didn't write turned a plausible demo into evidence. And an honest smaller claim beats an inflated one everywhere a judge might look.

What's next for GlassWake

Real connectors behind the same Authority Gate; semantic surface identity so a failed tool can retry through a different locator under one evidence lineage; and a broader action set — review tickets, executive notifications — each allowlisted, idempotent, and independently verified.

Northstar Supply is a synthetic merchant sandbox built for this demo — the business data is simulated. The workflow is not: orchestration, deterministic authority, the authenticated cross-service HTTPS mutation, idempotency, the independent fresh read, Firestore persistence, and the receipt all execute for real across two independently deployed Cloud Run services. Repo: https://github.com/heitormhm/glasswake — 61 backend + 41 frontend tests.