Places, Again

The plan breaks. The operation recovers.

Comment

Inspiration

I built Places, Again because I know this failure firsthand from live production. One absence is not one empty calendar cell: qualified cover, other people, rooms, scarce resources, availability windows, priorities and downstream calls all become coupled. Existing planning software describes yesterday's plan; the difficult work begins when reality makes that plan false.

Opera is the proving ground, not a claim that every industry is already implemented. A second synthetic commercial film/broadcast scenario runs through the same engine to prove portability across a different operational domain.

What it does

The user reports one incident once. The public Cloud Run API validates and persists it, returns an event_id, and publishes only that opaque ID through Pub/Sub. Authenticated OIDC delivery invokes a private Cloud Run worker running Google ADK and Gemini 3.5 on Vertex AI.

The workflow then:

  1. measures the operational blast radius;
  2. deterministically enumerates a bounded non-dominated set of hard-safe recovery candidates;
  3. lets Gemini select one supplied candidate ID using ranked soft operational priorities;
  4. rebuilds and independently re-verifies that candidate against current state;
  5. commits schedule + event ledger + audit + deterministic outbox atomically in Firestore;
  6. ends at human_required when safety cannot be proved.

Messages can be prepared, but the agent has no send tool and messages sent remain zero.

Why Gemini is necessary

Removing Gemini changes the operational choice, not the safety boundary.

In the opera baseline there are two genuine hard-safe strategies:

  • Candidate A: 0 highest-priority calls moved, 3 people changed, 270 shifted minutes;
  • Candidate B: 1 highest-priority call moved, 7 people changed, 240 shifted minutes.

Candidate B moves fewer minutes, but it disrupts the highest-priority call and changes more people's schedules. A fixed deterministic weight would encode one permanent soft-preference policy. Places, Again instead keeps hard safety deterministic and lets Gemini apply ranked contextual priorities only inside the already-safe set.

Gemini cannot invent or edit plans, waive a hard constraint, mutate Firestore, use shell/arbitrary HTTP/secrets, or send messages. An unknown candidate ID fails closed. Deterministic code re-verifies the selected state before Firestore can commit.

Gemini decides what makes operational sense. Deterministic code proves what is safe.

Visible result

All scenario data is synthetic.

Opera baseline:

  • 3 affected activities, 6 people, 3 resources;
  • 12.0 person-hours at risk;
  • 3/3 activities recovered;
  • 12.0 person-hours restored;
  • zero unaffected activities moved;
  • zero unresolved activities;
  • Firestore state v1 → v2 exactly once as a business effect;
  • 12 prepared-not-sent outbox items;
  • zero messages sent;
  • zero unsafe actions.

Commercial film/broadcast baseline: 4/4 activities recovered and 26.0 person-hours restored with zero unaffected activities moved, through the same candidate generator, Gemini selection contract, deterministic re-verification, transaction and UI.

Architecture

Cloud Run API → Pub/Sub/OIDC → private Cloud Run worker → Google ADK + Gemini 3.5 on Vertex AI → deterministic re-verification → Firestore

Pub/Sub is at-least-once. Places, Again therefore claims exactly-once business effect in the Firestore deployment, not exactly-once delivery. A stable event ledger plus one Firestore transaction prevents replay from applying the recovery twice or duplicating outbox items.

Challenges and what I learned

The hardest boundary was keeping model judgment useful without allowing it to become safety authority. The solution was to separate deterministic candidate generation and verification from Gemini's bounded selection among already-safe candidates.

Judge-path testing also exposed a Firestore persistence-size issue. Persisted ADK tool-result evidence is now bounded and terminal events no longer retain the full transient candidate payload. The recovery engine, safety authority, transaction boundary and replay semantics were unchanged, and regression coverage now verifies repeated demo evidence and Firestore-size headroom.

Production evidence

Final post-P0 live validation on 2026-08-30, revision places-again-00003-jz8:

  • exact UI-shaped public incident payload accepted with HTTP 202;
  • received → planned → completed;
  • two hard-safe candidates;
  • Gemini-selected candidate-a with validated reason codes;
  • deterministic re-verification PASS;
  • Firestore v1 → v2;
  • 3/3 activities and 12 person-hours recovered;
  • zero unaffected movement;
  • 12 prepared-not-sent outbox items, zero messages sent;
  • replay without a duplicate business effect;
  • adversarial unknown-person incident → human_required, no mutation/send.

Final reproducible repository baseline:

  • 67/67 automated tests;
  • 52/52 labeled evaluation cases;
  • zero unsafe commits;
  • zero duplicate business effects;
  • zero Gemini-invented candidate commits;
  • zero hard-constraint overrides;
  • 100% of committed candidates independently reverified.

Links

Built with

Gemini 3.5, Vertex AI, Google ADK, Google Cloud Run, Google Pub/Sub, Firestore, Python, FastAPI, Pydantic, JavaScript, HTML/CSS, Pytest and Docker.

Eligibility disclosure

I am submitting this project solely in my personal capacity. I am employed as a pianist/répétiteur by Opera Națională Română Timișoara, a Romanian public cultural institution. The project was created entirely on my own time, through my personal accounts, with no institutional funding, resources, data, authorization, procurement relationship, endorsement, ownership, or institutional benefit. My employer is not an entrant, participant, owner, or beneficiary of this submission and has no relationship with Google, Devpost, or the administration of this contest.

Because the Official Rules use the term “government agency,” and I saw the organizer’s clarification concerning employees of public universities, I have asked the organizers to confirm whether a non-administrative artistic position at a Romanian public cultural institution affects my eligibility. I submit in good faith with full disclosure and accept the Sponsor and Administrator’s final eligibility determination.

Built With

Share this project:

Updates

Submission history