Orqetra Fleet — Governed AI Execution

AI may hallucinate. It must not gain authority to act. Orqetra Fleet is a Gemini-powered Execution OS where agents propose, programs enforce, humans authorize, and outcomes are verified.

Comment

Inspiration

I cannot read or write source code.

My contribution was to define the product vision, the user-first Execution OS concept, the separation between AI reasoning, program-enforced boundaries, and human authority, and the acceptance criteria for trustworthy execution.

That perspective led to a simple question:

If AI agents can act on our behalf, how do we give them useful autonomy without giving them uncontrolled authority?

Most AI systems are optimized to generate better answers. Once an agent can create a business artifact, submit a form, send a message, or interact with an operational system, the problem changes. A hallucination is no longer only a bad answer—it can become an unauthorized or unsupported real-world action.

That is the problem Orqetra—the Execution OS for AI—is designed to solve.

We do not claim that Gemini will never hallucinate. We prevent unsupported model output from crossing the execution boundary merely because the model produced it. Before anything can be written, the organization must know what the AI proposed, which evidence supports it, whether that exact action is permitted, who authorized the exact bytes, what the executor wrote, and whether the resulting state matches the approval.

This matters especially for the “unlikely hero” inside a small organization: one person handling sales, administration, outreach, documents, and external communication across many applications. That operator needs the leverage of a specialist team, but may not have the staff or security organization required to supervise a conventional agent fleet.

Orqetra’s execution model is built around four principles:

  • AI reasons and proposes.
  • Programs enforce non-negotiable boundaries.
  • Humans retain authority over consequential actions.
  • The system verifies the resulting state.

Intelligence delegates. Authority stays human.

Hallucination containment at the execution boundary

Orqetra Fleet does not try to make hallucination impossible. It makes hallucination non-authoritative.

This distinction is the heart of the project.

A model may misunderstand evidence, invent a reference, omit required information, produce an invalid Plan, or generate fluent but unsupported content. Orqetra treats every model output as a proposal—not as permission and not as proof of completion.

The governed path places five independent boundaries between model output and a real action:

  1. Evidence binding: the Plan must reference server-owned evidence selected for that Run. Invented, missing, duplicated, or out-of-scope references fail closed.
  2. Exact Contract validation: the Program checks the unmodified AI-owned Plan, provider lineage, real ADK delegation, action type, filename, MIME type, content size, candidate hash, and Plan fingerprint. It may allow or deny; it may never repair the Plan into compliance.
  3. Human exact-byte authority: approval is cryptographically bound to the exact candidate SHA-256, size, filename, MIME type, and Plan fingerprint. Approval of one candidate cannot authorize different bytes.
  4. Bounded execution: only an allowed Plan with the matching durable approval binding can enter the executor, and the demonstrated action is limited to one Firestore artifact write.
  5. Post-action proof: completion comes from reading the stored bytes back and recomputing the hash—not from Gemini saying the work succeeded.

This is not “AI watching AI.” The enforcement boundary is deterministic software that the model cannot redefine through language.

The result is hallucination containment: unsupported AI output may exist as a rejected proposal, but it cannot silently become an approved artifact, an external mutation, or a false completed state.

A separation of powers for AI execution

Orqetra contains hallucination through a three-part separation of powers:

  • AI owns intelligence: Gemini interprets evidence, selects specialists, and proposes the exact Plan and candidate.
  • The Program owns the boundary: the deterministic Contract may allow or deny that exact proposal, but it cannot rewrite the AI’s intent or content.
  • The human owns consequential authority: only a human can authorize the exact candidate bytes for execution.

No participant can complete the chain alone. Gemini cannot approve itself. The Program cannot invent a compliant replacement. The human cannot authorize different bytes from the candidate that passed the Contract.

The executor and verifier operate beneath those three authorities: the executor performs only the bounded action already authorized, and the verifier proves the resulting state through readback. Neither can create new intent or permission.

This separation is the governance foundation of Orqetra Fleet:

AI proposes. The Program protects the boundary. The human grants authority. The system proves the result.

What it does

Orqetra is an Execution OS for AI: a governed execution layer between AI reasoning and the applications, tools, and business systems where real work happens.

It is not an operating system that replaces Windows, macOS, or a device OS. It is an execution operating layer that mediates access between AI-generated intent and real-world capabilities—just as a conventional operating system mediates access between applications and computing resources.

Orqetra Fleet is the hackathon-built, hosted demonstration of that Execution OS architecture. It connects Gemini reasoning and Google ADK delegation to shared Contract enforcement, human authority, bounded execution, durable state, and verified outcomes.

In the hosted demonstration, a judge selects server-owned synthetic evidence and starts one Fleet Run. Gemini interprets the objective, decides which specialist capabilities are required, delegates through Google ADK, and produces an exact Markdown candidate during Planning.

The candidate does not become executable merely because Gemini produced it. A deterministic public Contract validates the exact AI-owned Plan, including its evidence references, provider lineage, specialist delegation, action type, filename, MIME type, UTF-8 byte size, candidate SHA-256, and Plan fingerprint. The Program does not complete, summarize, repair, or rewrite the candidate.

Only after the Contract allows that exact Plan can a human approve the exact Markdown bytes. The executor then performs one bounded Firestore artifact write, reads the artifact back, recomputes its hash, and reports completion only when the readback matches the approved candidate.

The hosted lifecycle is:

Natural goal
→ Gemini planning
→ Google ADK specialist delegation
→ Program-enforced Contract
→ Human exact-byte approval
→ One bounded artifact write
→ Readback verification
→ Downloadable verified Markdown

If evidence is missing, the negative path stops before the provider or executor is reached. If Gemini returns an unsupported or invalid Plan, the Contract denies it without rewriting it. If any provider, schema, approval-binding, persistence, or readback invariant fails, the Run fails closed instead of presenting a false success.

Recorded hosted proof

We completed and froze one genuine Hosted Positive Run as the project’s recorded evidence. It used real Vertex AI Gemini 3.5 Flash and real Google ADK delegation—not a fake provider or precomputed success path.

The recorded Run produced:

  • 4 provider response events across 7 provider attempts;
  • 3 canonical Google ADK specialist delegations: Evidence, Artifact, and Verification;
  • one AI-owned Markdown candidate of 611 UTF-8 bytes;
  • candidate SHA-256 ddccc67b0e35cf6d53e7220b635c39bcb31eaee797f421a03bf03250259acde4;
  • a Program decision of allowed with every public check passing;
  • one human exact-byte approval;
  • one artifact write and one successful readback verification;
  • identical approved, written, readback, and downloaded bytes;
  • a unique, continuous audit timeline from sequence 1 through 19; and
  • a successful Founder browser download of atlas_sensor_brief.md.

The Firestore approval, action, artifact, and application-event identity form the application-level exactly-once boundary. Pub/Sub and Cloud Logging are correctly described as at-least-once delivery systems; we do not claim end-to-end exactly-once delivery for external sinks.

How we built it

We built the hackathon-specific Hosted Fleet demonstrator around Gemini 3.5 Flash, Google ADK, and Google Cloud.

Why Gemini

Orqetra Fleet begins with natural intent, not a fixed command menu. The meaning and order of required work can change with the goal and the available evidence.

Gemini owns the non-deterministic work that should belong to an intelligence layer: interpreting the selected evidence, deciding which specialists are needed, coordinating their results, and producing the exact candidate and structured Plan. Gemini is not an ornamental chatbot or a decorative API call. The successful Run cannot be reproduced by following a hard-coded Atlas-specific workflow.

Gemini 3.5 Flash is accessed through Vertex AI so the model executes under the Sandbox project’s enterprise identity and IAM boundary. Native structured output lets the Program receive a strict Plan without turning a fluent natural-language answer into implicit execution authority.

Why Google ADK

A fleet is only meaningful if delegation is real and inspectable.

Google ADK provides the runtime boundary for the Root Agent and its specialist AgentTools. Orqetra Fleet accepts delegation lineage only from canonical tool-call and tool-response evidence with matching identities and valid specialist schemas. Merely mentioning an agent in model text does not count as delegation.

This lets specialists evolve independently while all consequential actions continue through one shared Contract and approval path.

Why Google Cloud

Governed execution cannot depend on one browser tab or one founder’s laptop. It needs durable state, reproducible release lineage, scoped identity, and inspectable operational evidence.

Google Cloud is therefore part of the operating model, not a hosting checkbox:

  • Vertex AI runs Gemini 3.5 Flash under the Sandbox project’s identity.
  • Cloud Run hosts the judge-facing service as a revisioned, scalable runtime.
  • Artifact Registry stores the private image, deployed by root OCI digest rather than a mutable tag.
  • Cloud Firestore stores named-database Run state, exact approval bindings, the artifact, and verified readback state.
  • Cloud Pub/Sub carries durable audit events with at-least-once delivery semantics.
  • Cloud Logging provides an independently observable sanitized timeline.
  • Secret Manager and IAM keep credentials and runtime authority outside the source and browser.
  • Terraform constrains deployment changes and preserves auditable infrastructure lineage.

This combination gave us one coherent boundary from model reasoning to container lineage, durable state, human authority, execution, and post-action evidence.

Separation of intelligence, authority, and execution

The architecture deliberately prevents any single participant from controlling the entire chain:

  • Gemini proposes the Plan and candidate.
  • Google ADK records specialist delegation.
  • The Program evaluates deterministic public checks.
  • The human approves the exact bytes.
  • The executor writes once within a narrow capability.
  • The verifier reads back and compares the result.

The AI cannot grant itself permission. The Program cannot silently rewrite the AI’s work. The human cannot approve one candidate and cause different bytes to be saved. The executor cannot declare success without verified readback.

This is our practical separation of powers: intelligence, enforcement, and authority remain independent even though they participate in one execution lifecycle.

Pre-existing work disclosure

The broader Orqetra system existed before the All Things Agentic Hackathon. Over roughly four months, I directed the creation of a private codebase of approximately 300,000 lines through a human-led collaboration with two AI engineering partners: Hemo for product architecture, review, and claim discipline, and Fura, powered by Codex, for implementation, testing, and diagnosis.

That history is not claimed as hackathon work. It is also not included in the public repository or represented as the hosted execution shown to judges.

The newly created hackathon work is the IP-safe Orqetra Fleet Hosted Governance Demonstrator: the Gemini 3.5 Flash integration, Google ADK multi-agent orchestration, strict structured Plan boundary, public Contract, exact-byte human approval, Firestore artifact executor and readback verifier, durable audit pipeline, Google Cloud deployment, judge console, and reproducible Hosted Positive and Missing-Evidence Negative paths.

A patent application covering aspects of the broader Orqetra system is pending in Japan. The public repository and hosted demonstrator exclude the proprietary runtime and patent-sensitive internal implementation.

How one non-coding founder built it with AI

I did not manually write the implementation code.

I defined the product vision, architectural principles, priorities, safety decisions, expected behavior, and acceptance criteria. Hemo challenged the architecture, claims, and failure analysis. Fura/Codex inspected the repository, implemented changes, wrote tests, diagnosed live failures, and prepared auditable deployment candidates.

My responsibility remained human: define the goal, reject false success, decide what authority the system may exercise, and personally verify the final user-visible behavior.

This process was not “prompt once and ship.” We repeatedly found cases where infrastructure was healthy or tests were green while the governed user journey was still wrong. Each failure became a stricter public invariant, regression test, or fail-closed boundary. The final success was accepted only after the actual browser download matched the AI candidate, approval binding, persisted artifact, and readback hash.

Challenges we ran into

The central challenge was containing hallucination without destroying useful AI autonomy.

If we hard-coded the workflow, the project would no longer demonstrate meaningful agentic reasoning. If we trusted every model-generated Plan, fluent but unsupported output could become action. The answer was not to pretend the model could never be wrong. It was to give intelligence, authority, execution, and verification different owners.

Other major challenges included:

  • making native structured output and ADK delegation canonical rather than inferred;
  • preventing schema drift between the AI Plan, public projection, Contract, and persistence layers;
  • distinguishing provider attempts, provider responses, and specialist delegations accurately;
  • preserving deterministic event identity and chronology under retries and concurrency;
  • binding approval to exact bytes instead of a vague user intention;
  • preventing duplicate actions while keeping external audit sinks honestly at-least-once;
  • recovering safely from interrupted approval without manufacturing a second approval;
  • ensuring Firestore serialization could not partially write an invalid projection;
  • keeping raw prompts, credentials, provider responses, stack traces, and proprietary data out of public evidence; and
  • proving the complete path through a real hosted browser experience rather than a mocked success.

These were not cosmetic problems. Several appeared only during live acceptance testing. We froze failed Runs as evidence, fixed the responsible layer, and used a new clean Run for each acceptance attempt rather than altering history.

Accomplishments that we’re proud of

We are proud that Orqetra Fleet demonstrates hallucination containment as a working execution architecture—not as a prompt instruction, an “AI judge,” or a slide-deck claim.

It is not a chatbot presented as an agent and not a prerecorded simulation presented as execution.

The hosted project demonstrates a complete governed path:

  • real Gemini reasoning;
  • real Google ADK specialist delegation;
  • a strict AI-owned structured Plan;
  • a deterministic Contract that cannot be rewritten by the model;
  • human approval bound to the exact candidate bytes;
  • one bounded Firestore artifact write;
  • exact readback verification;
  • durable sanitized audit evidence; and
  • a verified artifact downloaded through the Founder’s browser.

We are also proud that the system fails closed. Missing evidence cannot reach the provider or executor. A Contract denial cannot be hidden behind an all-PASS display. An approval mismatch cannot write. A persistence error cannot partially commit. A readback mismatch cannot become completed.

That means Gemini remains free to perform meaningful reasoning, while unsupported output remains non-authoritative. This is the balance Orqetra was created to prove.

The result is not only a safer agent. It is a governed system with a visible separation of powers between AI intelligence, Program enforcement, and human authority.

Most of all, this project shows that a founder who cannot personally read or write source code can still lead the creation of a technically ambitious system by making precise product decisions, defining non-negotiable guarantees, testing real behavior, and remaining accountable for final acceptance.

What we learned

We learned that hallucination containment is a systems problem, not only a model-quality problem.

The safe claim is not “our model never hallucinates.” The safe architecture assumes that any model can be wrong and ensures that unsupported output cannot grant itself authority, mutate the external state, or certify its own success.

We learned that AI-first does not mean AI-authorized.

A model can interpret intent, select specialists, and create valuable work without becoming the source of its own permissions.

We learned that more agents make shared governance more important, not less. Without a common execution boundary, every specialist becomes another place where permissions, safety rules, and operational assumptions can diverge.

We learned that a successful API response is not the same as a successful action. Trustworthy execution requires an exact target, an exact approved candidate, durable state, one bounded attempt, and evidence from the resulting state.

We learned that production-minded AI execution systems must describe guarantees precisely. Firestore can provide an application-level exactly-once boundary for our artifact workflow, while Pub/Sub and Cloud Logging remain at-least-once external sinks. Honest semantics are stronger than a broader but false claim.

Finally, we learned that AI-assisted development increases the importance of human product leadership. AI can accelerate architecture, implementation, testing, and diagnosis, but the human must still define what “correct” means, notice false success, decide what authority is acceptable, and refuse to ship until the real behavior matches the claim.

What’s next for Orqetra Fleet

Our next goal is to expand the specialist and capability catalog without duplicating governance or rebuilding execution policy for every new action.

From application-specific adapters to a governed cloud execution layer

Google Cloud already provides much of the connectivity, identity, and execution transport needed to reach a growing ecosystem of services through APIs, Integration Connectors, and other tool interfaces. Orqetra could add the governed execution layer above that connectivity: evidence binding, deterministic Contract enforcement, exact human approval, bounded authority, and verified readback.

For systems already reachable through suitable Google APIs or connectors, this could replace many bespoke, application-specific Orqetra adapters with one reusable Google Cloud capability bridge plus system-specific governance profiles.

A common bridge would not make every connected system automatically executable. Each governed capability would still require a strict action schema, a stable target identity, bounded runtime credentials, an execution receipt, and authoritative post-action readback. Systems or connectors that do not provide these properties would still require dedicated integration.

The broader opportunity is to standardize these requirements at the provider layer instead of rebuilding connectivity, identity, execution, and verification separately inside every Orqetra adapter. In a native or jointly developed integration, Google Cloud could scale connector capabilities, identity, execution infrastructure, and enterprise distribution, while Utena Inc. would provide the provider-neutral Execution OS architecture that separates AI intelligence from the authority to act.

Provider-native agents could request or coordinate execution, but they could not bypass the deterministic Orqetra authority boundary or independently authorize a mutation.

Orqetra Fleet is our first working proof that this governance model can operate with Gemini, Google ADK, and Google Cloud. The demonstrated action is intentionally narrow: one exact-byte-approved Firestore artifact write followed by authoritative readback verification. Its purpose is to prove the shared governance boundary before expanding capability coverage.

It is not a claim that every Google-connected or legacy system is already adapter-free. It is a working demonstration of how provider-native execution capabilities could be made governable through one reusable architecture.

To pursue this direction, we plan to develop:

  • longer-running organizational workflows;
  • richer agent discovery and lifecycle management;
  • organization-specific capability and authority profiles;
  • a reusable Google Cloud capability bridge;
  • governance-ready action, target, receipt, and readback profiles;
  • stronger operational evaluation and observability;
  • additional governed artifact, communication, and business-workflow capabilities; and
  • enterprise pilots for workflows where trust matters as much as automation.

Orqetra is the Execution OS through which organizations can add new intelligence rapidly while keeping consequential action governed, observable, and ultimately under human authority.

Natural intent in. Verified action out.

Built With

Share this project:

Updates

Submission history