-
-
Landing: Night Shift turns a freezer alarm into an autonomous, proof-carrying rescue before the overnight operator has to orchestrate it.
-
Incident: A closed SEV1 rescue: 42/42 containers reconciled, zero unresolved, with all 13 safety invariants passing.
-
Capacity: Transactional capacity control reserves only safe, fresh backup space—two incidents racing for the last slot cannot both win.
-
Fleet: Six Gemini specialists use separate Google identities, explicit tool permissions, and deny-by-default authority boundaries.
-
Drills: 126/126 deterministic drills and 17/18 live Gemini runs, with faults, denials, and the single failure published—not hidden.
-
Evidence: Every product claim links to its raw artifact, limitation, and reproduction command in a judge-readable evidence ledger.
-
Signed proof: Cloud KMS–signed proof recomputes the incident from its state snapshot without relying on an AI model.
-
Verifier: Anyone can verify the manifest independently: hashes, signature, reconciliation, and all 13 invariants are recomputed.
Inspiration
What it does
How we built it
Inspiration
A -80°C research freezer can hold years of irreplaceable biological material.
Existing monitoring systems are good at telling a lab that a freezer is warming. The harder problem begins after the alarm: determine whether the failure is real, identify what is at risk, find qualified backup capacity, get someone on site, preserve chain of custody, refuse unsafe transfers, and prove afterward that every affected container is accounted for.
Today, much of that becomes a manual 2AM coordination problem for a lab manager.
Night Shift is built for that person.
What it does
Night Shift is a six-agent Gemini 3.5 Flash fleet that coordinates a research-freezer incident from alarm to reconciled custody.
The agents divide the work across separate authority domains:
- Incident Commander — plans and delegates, but holds no mutation authority
- Signal Investigator — determines whether the freezer is genuinely failing
- Impact Analyst — identifies affected material and urgency
- Capacity Broker — finds and reserves qualified backup capacity
- Dispatch Agent — coordinates work orders and responders
- Custody Agent — verifies transfer evidence and commits custody changes
The whole system follows one rule:
Agents decide what to do. Deterministic code decides what is true and whether state may change.
A model can propose a transfer. It cannot make that transfer valid.
Every consequential action passes through a deterministic Rescue Safety Kernel containing 13 invariants covering capacity conservation, exactly-once effects, fresh telemetry, custody prerequisites, reconciliation, least privilege, stale memory, duplicate events, revision qualification, contradiction handling, failure attribution, and containment integrity.
If the evidence is insufficient, Night Shift refuses the action and records why.
Why this is a fleet instead of one agent with six tools
The separation is about authority, not personas.
Each specialist has its own tool domain and its own Google service account.
For example, the Dispatch Agent has no inventory authority. We tested that boundary against the deployed system: ns-dispatch calling the Inventory service receives HTTP 403 from the Cloud Run edge, while an authorized identity receives HTTP 200 on the same route.
The Commander cannot move specimens. The Capacity Broker cannot commit custody. The Custody Agent cannot create reservations.
The gaps in the permission matrix are part of the architecture.
How we built it
Night Shift uses:
- Gemini 3.5 Flash through Vertex AI
- Google Agent Development Kit 2.7.1
- Cloud Run
- Firestore
- Cloud IAM
- Cloud KMS
- Cloud Storage
- Cloud Trace
- Model Armor
- Gemma 4 on Vertex AI
- Cloud Scheduler
- Cloud Build
- Artifact Registry
Six authenticated domain services run on Cloud Run under six distinct Google service accounts. Firestore is the authoritative state store. Every effect uses a semantic action ID and an idempotent transaction, so retrying the same logical action returns the existing receipt rather than creating a second effect.
Completed incidents are sealed into signed evidence manifests using Cloud KMS. A reviewer can download a public manifest and recompute all 13 invariants locally with no Google credentials.
The estate, specimens, responders, telemetry, and physical movements used for the submission are synthetic or simulated. No real patient data, research data, or biobank material is involved.
The resumability finding
One of the most important findings came from testing Google ADK resumability directly.
We interrupted the same effectful tool three ways:
| Interruption | Tool re-invoked after resume? |
|---|---|
| plugin raises after tool returns | No |
| tool raises after committing | No |
| invocation cancelled mid-flight | Yes |
The cancelled invocation made 2 tool calls and produced 1 committed effect.
The second invocation carried the same semantic action ID, found the receipt created by the first, and returned it instead of committing another reservation.
That is why Night Shift treats idempotency as a property of the real-world action, not of an HTTP request or retry counter.
Measured, not asserted
We keep deterministic-system testing and live-agent testing separate.
Deterministic tier
Across the full 21-drill corpus and six seeds:
- 126 / 126 runs passed
- 3,252 custody commits
- 54 injected faults across 36 runs
- 0 duplicate semantic effects under those injected faults
- 24 broker authorization denials
- median runtime: 0.6 seconds
Live Gemini-agent tier
Across 18 model-driven runs covering 9 drills:
- 17 / 18 passed
- 332 custody commits
- 0 containers unresolved
- 162 model calls
- median runtime: 191.12 seconds
- no human intervention
The one failed live-agent drill is published rather than hidden.
Proving that the Safety Kernel actually matters
A passing system does not prove which mechanism made it safe, so we also ran an ablation.
Using the exact same deterministic corpus:
- Safety Kernel enabled: 126 / 126
- Safety Kernel removed: 96 / 126
Removing it exposed violations of the fresh-evidence and revision-qualification invariants.
N1, N2, and N3 still held in both arms because capacity conservation, exactly-once effects, and custody prerequisites are also protected by separate authorization and transactional mechanisms.
That null result is intentional: Night Shift uses defense in depth rather than pretending one component provides every safety property.
Testing probabilistic security layers
We also measured the content-screening path against six malicious payloads and three benign controls.
Against the six malicious payloads:
- Model Armor: 2 / 6
- local heuristic: 4 / 6
- Gemma classifier: 6 / 6
The three benign controls produced no observed false positives, but three examples are far too small to call that a false-positive rate.
More importantly, content screening is not the final security boundary.
Even where a probabilistic screening layer misses malicious content, the Dispatch Agent still has no inventory authority and cannot perform the requested action.
Verifiable evidence
Night Shift currently publishes two signed incident manifests.
The flagship closed incident is:
INC-0E7C54F8B5
A reviewer can fetch its manifest directly over HTTPS and run the verifier with no credentials.
The verifier independently recomputes all 13 invariants and verifies the pinned signing key.
Tamper with the state, verdict, or signature and the verifier reports a mismatch rather than trusting the stored result.
Cloud Trace is also exercised in the deployed system: the measured evidence window contains 25 traces, 496 application spans, and 44 span names.
Challenges we faced
The hardest problems were not prompt engineering.
They were systems problems:
- making an action safe when an agent resumes after a worker dies
- preventing two incidents from allocating the same capacity
- proving which agent identity is actually reaching a deployed service
- separating probabilistic security screening from deterministic authority
- making signed evidence independently verifiable rather than self-referential
- distinguishing infrastructure failures from agent failures
- keeping public claims synchronized with what the artifacts actually prove
Several early assumptions were wrong and were corrected publicly in DECISIONS.md, SECURITY.md, and LIMITATIONS.md.
What we learned
The strongest lesson from the build is:
An agent transcript is not a system of record.
A model can believe an action succeeded when the external effect never committed. It can believe an action failed after the world already changed.
For consequential workflows, the system needs independent state, deterministic invariants, stable action identities, and receipts for what actually happened.
We also learned that failure testing has to match the failure that happens in production. Raising an exception and killing a running worker produced different ADK resume behavior.
What is deliberately not claimed
Night Shift does not claim:
- real biobank deployment
- regulatory compliance
- real specimen movement
- exhaustive security coverage
- that agents always make good operational decisions
Managed Agent Registry, Agent Runtime, Agent Gateway, managed Semantic Governance, and managed Memory Bank are also not presented as delivered integrations.
The submitted system instead uses Cloud Run, separate Google service accounts, IAM authorization, a deny-by-default broker, Firestore qualification state, and local implementations where applicable.
What's next
A production deployment would replace the synthetic adapters one by one:
existing freezer monitoring system
→ Night Shift
→ institutional LIMS
→ facilities/work-order platform
→ staff identity and responder systems
The wedge is not replacing freezer monitoring or the laboratory information system.
It is owning the operational span between “the freezer is failing” and “every affected specimen is accounted for, and here is the evidence.”
Log in or sign up for Devpost to join the conversation.